Information Security Commons^™

Safeguarding Virtual Healthcare: A Novel Attacker-Centric Model For Data Security And Privacy, Suvineetha Herath, Haywood Gelman, John Hastings, Yong Wang

Research & Publications

The rapid growth of remote healthcare delivery has introduced significant security and privacy risks to protected health information (PHI). Analysis of a comprehensive healthcare security breach dataset covering 2009-2023 reveals their significant prevalence and impact. This study investigates the root causes of such security incidents and introduces the Attacker-Centric Approach (ACA), a novel threat model tailored to protect PHI. ACA addresses limitations in existing threat models and regulatory frameworks by adopting a holistic attacker-focused perspective, examining threats from the viewpoint of cyber adversaries, their motivations, tactics, and potential attack vectors. Leveraging established risk management frameworks, ACA provides a multi-layered approach …

Microsegmented Cloud Network Architecture Using Open-Source Tools For A Zero Trust Foundation, Sunil Arora, John Hastings

Research & Publications

This paper presents a multi-cloud networking architecture built on zero trust principles and micro-segmentation to provide secure connectivity with authentication, authorization, and encryption in transit. The proposed design includes the multi-cloud network to support a wide range of applications and workload use cases, compute resources including containers, virtual machines, and cloud-native services, including IaaS (Infrastructure as a Service), PaaS (Platform as a service). Furthermore, open-source tools provide flexibility, agility, and independence from locking to one vendor technology. The paper provides a secure architecture with micro-segmentation and follows zero trust principles to solve multi-fold security and operational challenges.

Exploring Secure Methods For Ensuring Data Integrity: A Theoretical Analysis Of Cryptographic And Detection Techniques, Haryam Garcia Martinez

Electronic Theses, Projects, and Dissertations

This study investigates cryptographic methods to ensure data integrity within cloud environments, with a particular focus on comparing the security, performance, and efficiency of MD5 and SHA-256 hash algorithms. Data integrity is critical for protecting sensitive information, especially in sectors like healthcare, where cloud storage solutions are increasingly prevalent. Through a theoretical analysis, the study evaluates the advantages and limitations of MD5 and SHA-256, emphasizing SHA-256’s stronger security capabilities in preventing collision attacks compared to MD5, albeit with higher resource consumption.

The literature review draws from recent advancements in cryptography, blockchain, and artificial intelligence (AI) technologies, presenting a comprehensive view …

The Effects Of Covid-19 Lockdowns On Cybersecurity, Natalie Sanders

Electronic Theses, Projects, and Dissertations

The COVID-19 pandemic and subsequent lockdowns forced many Americans to quickly adapt to working from home, many of which had never done so in the past. In addition, organizations were forced to modify security policies and protocols to allow for remote access to sensitive information. The rapid change in security policies as well as the sudden growth of remote access during the pandemic presented a broader landscape for cyber criminals to attack. In this report, we review the number and type of cyberattacks reported from two (2) years before the pandemic through two (2) years after (1998 through 2023), to …

Gotcha ! This Model Uses My Code ! Evaluating Membership Leakage Risks In Code Models, Zhou Yang, Zhipeng Zhao, Chenyu Wang, Jieke Shi, Dongsum Kim, Donggyun Han, David Lo

Research Collection School Of Computing and Information Systems

Leveraging large-scale datasets from open-source projects and advances in large language models, recent progress has led to sophisticated code models for key software engineering tasks, such as program repair and code completion. These models are trained on data from various sources, including public open-source projects like GitHub and private, confidential code from companies, raising significant privacy concerns. This paper investigates a crucial but unexplored question: What is the risk of membership information leakage in code models? Membership leakage refers to the vulnerability where an attacker can infer whether a specific data point was part of the training dataset. We present …

Shield-U: Safeguarding Traffic Sign Recognition Against Perturbation Attacks, Shengmin Xu, Jianfei Sun, Hangcheng Cao, Yulan Gao, Ziyang He, Cong Wu

Research Collection School Of Computing and Information Systems

Traffic sign recognition systems are crucial for the navigation and situation awareness of autonomous vehicles. They leverage deep learning technologies to swiftly and accurately identify traffic signs, even in the most challenging traffic environments. However, security researchers have uncovered a critical vulnerability in these systems: learning-based TSRs are particularly susceptible to physical-world perturbation attacks. Through subtle modifications (i.e., attaching well-designed patches on traffic signs), attackers can deceive the recognition system into making erroneous judgments, which can further lead to serious traffic accidents. Although several defense mechanisms have been proposed to enhance the security of sign recognition systems, these solutions generally …

Custom Permission Misconfigurations In Android: A Large-Scale Security Analysis, Rui Li, Wenrui Diao, Debin Gao

Research Collection School Of Computing and Information Systems

Android’s popularity is due to its openness and vast app ecosystem. Global developers can use Android Studio and rich Android APIs to create their apps. Within this ecosystem, Android permissions play a crucial role in managing access to resources, with system permissions controlled by system apps and custom permissions declared by third-party apps. However, the security of custom permissions has not received enough attention from the mobile security community, resulting in a lack of thorough evaluation of security practices for app developers using custom permissions. This study systematically evaluated the misconfiguration of custom permissions by Android app developers. It is …

Enhancing Password Security And Memorability Using Machine Learning And Linguistic Patterns, Jared Wise

LSU New Orleans Theses and Dissertations

In the digital age, text-based passwords remain a primary method for securing online accounts. Yet, users frequently face a dilemma between creating passwords that are easy to remember and sufficiently secure against cyberattacks. This research introduces an approach to password generation that bridges this gap by utilizing linguistic patterns, particularly song lyrics, to develop highly secure and naturally memorable passwords. Using large lyric datasets gained from web scrapes from popular song lyric websites (AZ Lyrics, Genius), features are extracted from a corpus of over 5 million lyrics using sentence structure and natural language processing in a novel way. In using …

Towards Privacy-Aware Iot Communications: Delegable, Revocable, And Efficient, Pengfei Wu, Jianfei Sun, Guomin Yang, Robert H. Deng

Research Collection School Of Computing and Information Systems

The Internet of Things (IoT) is widely recognized for its potential to enhance efficiency and productivity across various industries. However, its increasing prevalence has also made it a more attractive target for cybercriminals. While many advanced cryptographic solutions have been developed to secure IoT, some practical security and privacy issues such as self-sovereign delegation, flexible revocation, and lightweight access remain inadequately addressed in existing solutions. In this paper, we propose PLIC, a Privacy-aware Lightweight IoT Communication scheme, which not only enables any authorized user to flexibly delegate their lightweight access privileges to other delegatees, such that they can also access …

Ohss: Optimizing Homomorphic Secret Sharing To Support Fast Matrix Multiplication, Shuguang Zhang, Jianli Bai, Kun Tu, Ziyue Yin, Chan Liu

Research Collection School Of Computing and Information Systems

Homomorphic Secret Sharing (HSS) has evolved as a state-of-the-art methodology for achieving secure two-party computation, synthesizing the advantages of secret sharing and homomorphic encryption. This amalgamation ensures minimal computational and communicational overhead, making it particularly adept at arithmetic operations. However, HSS faces challenges in scalability and efficiency when confronted with extensive matrix operations, including both matrix-vector and matrix-matrix multiplications, which are fundamental in numerous privacy-preserving computations, notably within the realm of privacy-preserving machine learning. In this research, we introduce Optimized Homomorphic Secret Sharing (OHSS), a refined version of HSS, crafted to address these limitations. Our contributions include enhancements to the …

Generative Semi-Supervised Graph Anomaly Detection, Hezhe Qiao, Qingsong Wen, Xiaoli Li, Ee-Peng Lim, Guansong Pang

Research Collection School Of Computing and Information Systems

This work considers a practical semi-supervised graph anomaly detection (GAD) scenario, where part of the nodes in a graph are known to be normal, contrasting to the extensively explored unsupervised setting with a fully unlabeled graph. We reveal that having access to the normal nodes, even just a small percentage of normal nodes, helps enhance the detection performance of existing unsupervised GAD methods when they are adapted to the semi-supervised setting. However, their utilization of these normal nodes is limited. In this paper we propose a novel Generative GAD approach (namely GGAD) for the semi-supervised scenario to better exploit the …

Sampdetox : Black-Box Backdoor Defense Via Perturbation-Based Sample Detoxification, Yanxin Yang, Chentao Jia, Dengke Yan, Ming Hu, Tianlin Li, Xiaofei Xie, Xian Wei, Mingsong Chen

Research Collection School Of Computing and Information Systems

The advancement of Machine Learning has enabled the widespread deployment of Machine Learning as a Service (MLaaS) applications. However, the untrustworthy nature of third-party ML services poses backdoor threats. Existing defenses in MLaaS are limited by their reliance on training samples or white-box model analysis, highlighting the need for a black-box backdoor purification method. In our paper, we attempt to use diffusion models for purification by introducing noise in a forward diffusion process to destroy backdoors and recover clean samples through a reverse generative process. However, since a higher noise also destroys the semantics of the original samples, it still …

Container Runtime Vulnerability Mitigation Using User Namespace Isolation, Alexander Edsell

Electronic Theses, Projects, and Dissertations

Although containers have revolutionized application deployment by allowing for rapid and consistent deployment, their growing adoption has also raised significant security concerns. Each container is an isolated instance of an operating system that comes pre-packaged with the users desired applications. With multiple containers running on a host machine, an adversary can potentially break out of the container into the host machine. This project investigates the effectiveness of user namespace isolation as a security mechanism to mitigate container escape vulnerabilities that target the container’s runtime.

The research questions are: Question 1, does user namespace isolation mitigate container runtime vulnerabilities that target …

Causality Analysis For Neural Network Security, Bing Sun

Dissertations and Theses Collection (Open Access)

While neural networks are demonstrating excellent performance in a wide range of applications, there has been a growing concern on their reliability and dependability.Similar to traditional decision-making programs, neural networks inevitably have defects that need to be identified and mitigated at times. Neural networks are usually inherently black-boxes and do not provide explanations on how and why decisions are made. As a result, these defects are more ``hidden" and more challenging to eliminate. It is thus crucial to develop systematic approaches to identify and mitigate defects in a neural network in a rigorous way.

In this dissertation, we focus on …

Towards Robust, Secure, And Privacy-Aware Large Language Models Of Code, Zhou Yang

Dissertations and Theses Collection (Open Access)

The field of software engineering has witnessed a surge in large language models specifically tailored to understand and process code, which we call large language models for code (LLM4Code). The increasing popularity of LLM4Code is inseparable from three key factors: the availability of extensive datasets compiled from diverse data sources, the advancements in deep learning algorithms and computational power that facilitate the training of these powerful models, and the active engagement and collaboration within the research community fostering innovation and the rapid exchange of ideas and methodologies. As evidenced by a series of studies, LLM4Code has been experiencing rapid development …

Hybrid Deep Learning-Based Model For Eclipse Attack Detection On Ethereum Network, Dhanasak Bhumichai

Graduate Theses and Dissertations (2019 - present)

An eclipse attack is a significant cyber threat targeting the network layer of blockchain platforms. Detecting eclipse attacks is challenging for several reasons. First, there are no available datasets for training and testing models. Second, comprehensive studies identifying features to detect eclipse attacks are lacking. Additionally, the amount of eclipse network traffic is much smaller than that of normal network traffic, which leads to imbalanced samples. Moreover, the characteristics of eclipse network traffic closely resemble those of normal traffic, causing overlapping samples, which makes it challenging for traditional classifiers to learn how to identify eclipse attacks. To address these challenges, …

Gtree: Gpu-Friendly Privacy-Preserving Decision Tree Training And Inference, Qifan Wang, Shujie Cui, Lei Zhou, Ye Dong, Jianli Bai, Yun Sing Koh, Giovanni Russello

Research Collection School Of Computing and Information Systems

Outsourcing Decision tree (DT) training and inference to cloud platforms raises privacy concerns. Recent Secure Multi-Party Computation (MPC)-based methods are hindered by heavy overhead. Few recent studies explored GPUs to improve MPC-protected deep learning, yet integrating GPUs into MPC-protected DT with massive data-dependent operations remains challenging, raising question: can MPC-protected DT training and inference fully leverage GPUs for optimal performance?We present GTree, the first scheme that exploits GPU to accelerate MPC-protected secure DT training and inference. GTree is built across 3 parties who jointly perform DT training and inference with GPUs. GTree is secure against semi-honest adversaries, ensuring that no …

Exploiting Randomness In Secret Sharing, Cailyn Bass

All Theses

Shamir's (k,n)-threshold scheme is a method for sharing a secret among n participants such that any group of k or more participants can recover the secret. Additionally, any group of participants with size less than k should learn nothing about the secret. The scheme works by distributing a share to each participant, where each share is a linear combination of the secret and k-1 random symbols. This allows any group of k or more participants to solve a linear system to compute the secret. Any group of less than k participants does not have enough to determine anything about the …

Forward And Backward Private Searchable Encryption For Cloud-Assisted Industrial Iot, Tianqi Peng, Bei Gong, Shanshan Tu, Abdallah Namoun, Sami Alshmrany, Muhammad Waqas, Hisham Alasmary, Sheng Chen

Research outputs 2022 to 2026

In the cloud-assisted industrial Internet of Things (IIoT), since the cloud server is not always trusted, the leakage of data privacy becomes a critical problem. Dynamic symmetric searchable encryption (DSSE) allows for the secure retrieval of outsourced data stored on cloud servers while ensuring data privacy. Forward privacy and backward privacy are necessary security requirements for DSSE. However, most existing schemes either trade the server’s large storage overhead for forward privacy or trade efficiency/overhead for weak backward privacy. These schemes cannot fully meet the security requirements of cloud-assisted IIoT systems. We propose a fast and firmly secure SSE scheme called …

Digital Humanities: Using Computational Methods On Literature To Understand Human-Water Relations, Ariel Yang

Cybersecurity Undergraduate Research Showcase

By using computational techniques to analyze literature, deeper insights can be gained into human-water relationships across different historical and cultural contexts. Natural Language Processing (NLP) and other data science methods can explore applications of traditional ecological knowledge (TEK) and underlying emotions or beliefs in literature to help understand sustainability. Protecting this sensitive cultural data through ethical applications can further secure future implementations of policies, urban planning, and environmental relationships.