Information Security Commons^™

Efficient Privacy-Preserving Spatial Data Query In Cloud Computing, Yinbin Miao, Yutao Yang, Xinghua Li, Linfeng Wei, Zhiquan Liu, Robert H. Deng

Research Collection School Of Computing and Information Systems

With the rapid development of geographic location technology and the explosive growth of data, a large amount of spatial data is outsourced to the cloud server for reducing the local high storage and computing burdens, but at the same time causes security issues. Thus, extensive privacy-preserving spatial data query schemes have been proposed. Most of the existing schemes use Asymmetric Scalar-Product-Preserving Encryption (ASPE) to encrypt data, but ASPE has proven to be insecure against known plaintext attack. And the existing schemes require users to provide more information about query range and thus generate a large amount of ciphertexts, which causes …

Provably Secure Decisions Based On Potentially Malicious Information, Dongxia Wang, Tim Muller, Jun Sun

Research Collection School Of Computing and Information Systems

There are various security-critical decisions routinely made, on the basis of information provided by peers: routing messages, user reports, sensor data, navigational information, blockchain updates, etc. Jury theorems were proposed in sociology to make decisions based on information from peers, which assume peers may be mistaken with some probability. We focus on attackers in a system, which manifest as peers that strategically report fake information to manipulate decision making. We define the property of robustness: a lower bound probability of deciding correctly, regardless of what information attackers provide. When peers are independently selected, we propose an optimal, robust decision mechanism …

Data Science In Finance: Challenges And Opportunities, Xianrong Zheng, Elizabeth Gildea, Sheng Chai, Tongxiao Zhang, Shuxi Wang

Information Technology & Decision Sciences Faculty Publications

Data science has become increasingly popular due to emerging technologies, including generative AI, big data, deep learning, etc. It can provide insights from data that are hard to determine from a human perspective. Data science in finance helps to provide more personal and safer experiences for customers and develop cutting-edge solutions for a company. This paper surveys the challenges and opportunities in applying data science to finance. It provides a state-of-the-art review of financial technologies, algorithmic trading, and fraud detection. Also, the paper identifies two research topics. One is how to use generative AI in algorithmic trading. The other is …

A Secure And Privacy-Preserving Signature Protocol Using Quantum Teleportation In Metaverse Environment, Pankaj Kumar, Vivek Bharmaik, Sunil Prajapat, Garima Thakur, Ashok Kumar Das, Sachin Shetty, Joel J. P. C. Rodrigues

VMASC Publications

The burgeoning concept of the metaverse as an interconnected virtual space represents the forefront of the next-generation internet. Quantum teleportation, known for its prowess in ensuring secure and reliable communications, stands poised to revolutionize interactions within this immersive digital realm. In this context, we propose a comprehensive interaction protocol tailored for the metaverse environment. The designed protocol entails two fundamental components: first, the interaction between a user and their avatar, facilitated by a secure seven-qubit entangled state; and second, the interaction between two avatars, enabled through an efficient two-qubit entangled state. To fortify the protocol’s resilience, quantum key distribution (QKD) …

Designing A Blockchain-Empowered Telehealth Artifact For Decentralized Identity Management And Trustworthy Communication: Interdisciplinary Approach, Xueping Liang, Nabid Alam, Tahmina Sultana, Eranga Bandara, Sachin Shetty

VMASC Publications

Background: Telehealth played a critical role during the COVID-19 pandemic and continues to function as an essential component of health care. Existing platforms cannot ensure privacy and prevent cyberattacks.

Objective: The main objectives of this study are to understand existing cybersecurity issues in identity management and trustworthy communication processes in telehealth platforms and to design a software architecture integrated with blockchain to improve security and trustworthiness with acceptable performance.

Methods: We improved personal information security in existing telehealth platforms by adopting an innovative interdisciplinary approach combining design science, social science, and computer science in the health care domain, with prototype …

A Defensive Strategy Against Android Adversarial Malware Attacks, Fabrice Setephin Atedjio, Jean-Pierre Lienou, Frederica F. Nelson, Sachin S. Shetty, Charles A. Kamhoua

VMASC Publications

Due to the popularity of Android mobile devices over the past ten years, malicious Android applications have significantly increased. Systems utilizing machine learning techniques have been successfully applied for Android malware detection to counter the constantly changing Android malware threats. However, attackers have developed new strategies to circumvent these systems by using adversarial attacks. An attacker can carefully craft a malicious sample to deceive a classifier. Among the evasion attacks, there is the more potent one, which is based on solid optimization constraints: the Carlini-Wagner attack. Carlini-Wagner is an attack that uses margin loss, which is more efficient than cross-entropy …

Demystifying The Hosting Infrastructure Of The Free Content Web: A Security Perspective, Mohammed Alqadhi

Graduate Thesis and Dissertation 2023-2024

This dissertation delves into the security of free content websites, a crucial internet component that presents significant security challenges due to their susceptibility to exploitation by malicious actors. While prior research has highlighted the security disparities between free and premium content websites, it has not delved into the underlying causes. This study aims to address this gap by examining the security infrastructure of free content websites. The research commences with an analysis of the content management systems (CMSs) employed by these websites and their role. Data from 1,562 websites encompassing free and premium categories is collected to identify CMS usage …

Cyclegan-Gradient Penalty For Enhancing Android Adversarial Malware Detection In Gray Box Setting, Fabrice Setephin Atedjio, Jean-Pierre Lienou, Frederica F. Nelson, Sachin S. Shetty, Charles A. Kamhoua

VMASC Publications

Adversarial attacks pose significant threats to Android malware detection by undermining the effectiveness of machine learning-based systems. The rapid increase in Android apps complicates the management of malicious software that can compromise user defense solutions. Many current Android defense techniques rely on deep learning methods. Malicious users exploit GAN-based attacks to achieve adversarial attack transferability and deceive target models by crafting adversarial examples based on known models. We propose a new model based on a Cycle Generative Adversarial Network (CycleGAN) to detect GAN-based attacks. This model incorporates a gradient penalty to enhance the detection rate of the target model. Our …

Designing High-Performance Identity-Based Quantum Signature Protocol With Strong Security, Sunil Prajapat, Pankaj Kumar, Sandeep Kumar, Ashok Kumar Das, Sachin Shetty, M. Shamim Hossain

VMASC Publications

Due to the rapid advancement of quantum computers, there has been a furious race for quantum technologies in academia and industry. Quantum cryptography is an important tool for achieving security services during quantum communication. Designated verifier signature, a variant of quantum cryptography, is very useful in applications like the Internet of Things (IoT) and auctions. An identity-based quantum-designated verifier signature (QDVS) scheme is suggested in this work. Our protocol features security attributes like eavesdropping, non-repudiation, designated verification, and hiding sources attacks. Additionally, it is protected from attacks on forgery, inter-resending, and impersonation. The proposed scheme benefits from the traditional designated …

Heuristic Machine Learning Approaches For Identifying Phishing Threats Across Web And Email Platforms, Ramprasath Jayaprakash, Krishnaraj Natarajan, J. Alfred Daniel, Chandru Vignesh Chinnappan, Jayant Giri, Hong Qin, Saurav Mallik

Data Science Faculty Publications

Life has become more comfortable in the era of advanced technology in this cutthroat competitive world. However, there are also emerging harmful technologies that pose a threat. Without a doubt, phishing is one of the rising concerns that leads to stealing vital information such as passwords, security codes, and personal data from any target node through communication hijacking techniques. In addition, phishing attacks include delivering false messages that originate from a trusted source. Moreover, a phishing attack aims to get the victim to run malicious programs and reveal confidential data, such as bank credentials, one-time passwords, and user login credentials. …

Anonymous Attribute-Based Broadcast Encryption With Hidden Multiple Access Structures, Tran Viet Xuan Phuong

School of Cybersecurity Faculty Publications

Due to the high demands of data communication, the broadcasting system streams the data daily. This service not only sends out the message to the correct participant but also respects the security of the identity user. In addition, when delivered, all the information must be protected for the party who employs the broadcasting service. Currently, Attribute-Based Broadcast Encryption (ABBE) is useful to apply for the broadcasting service. (ABBE) is a combination of Attribute-Based Encryption (ABE) and Broadcast Encryption (BE), which allows a broadcaster (or encrypter) to broadcast an encrypted message, including a predefined user set and specified access policy to …

A Systemic Mapping Study On Intrusion Response Systems, Adel Rezapour, Mohammad Ghasemigol, Daniel Takabi

School of Cybersecurity Faculty Publications

With the increasing frequency and sophistication of network attacks, network administrators are facing tremendous challenges in making fast and optimum decisions during critical situations. The ability to effectively respond to intrusions requires solving a multi-objective decision-making problem. While several research studies have been conducted to address this issue, the development of a reliable and automated Intrusion Response System (IRS) remains unattainable. This paper provides a Systematic Mapping Study (SMS) for IRS, aiming to investigate the existing studies, their limitations, and future directions in this field. A novel semi-automated research methodology is developed to identify and summarize related works. The innovative …

Passperfect: A Secure One Time Password Authentication System, Charlene H. Crawshaw

UNF Graduate Theses and Dissertations

Most organizations have established strong password policies and standards to ensure the confidentiality, integrity, and availability of their data, applications, and critical systems. Even with rigorous implementations and layered approaches such as utilizing multifactor authentications, there are still flaws and vulnerabilities as they have a high dependency on the user adhering to them. In conjunction with these policies, a strong security awareness program should be implemented to educate the end user about strong password hygiene. In this work, we design and implement a secure one-time password (OTP) system, “PassPerfect”, to provide a method of enforcing a strong set of password …

Soci+: An Enhanced Toolkit For Secure Outsourced Computation On Integers, Bowen Zhao, Weiquan Deng, Xiaoguo Li, Ximeng Liu, Qingqi Pei, Robert H. Deng

Research Collection School Of Computing and Information Systems

Secure outsourced computation is critical for cloud computing to safeguard data confidentiality and ensure data usability. Recently, secure outsourced computation schemes following a twin-server architecture based on partially homomorphic cryptosystems have received increasing attention. The Secure Outsourced Computation on Integers (SOCI) [1] toolkit is the state-of-the-art among these schemes which can perform secure computation on integers without requiring the costly bootstrapping operation as in fully homomorphic encryption; however, SOCI suffers from relatively large computation and communication overhead. In this paper, we propose SOCI+ which significantly improves the performance of SOCI. Specifically, SOCI+ employs a novel (2,2)-threshold Paillier cryptosystem with fast …

A Secure And Robust Knowledge Transfer Framework Via Stratified-Causality Distribution Adjustment In Intelligent Collaborative Services, Ju Jia, Siqi Ma, Lina Wang, Yang Liu, Robert H. Deng

Research Collection School Of Computing and Information Systems

The rapid development of device-edge-cloud collaborative computing techniques has actively contributed to the popularization and application of intelligent service models. The intensity of knowledge transfer plays a vital role in enhancing the performance of intelligent services. However, the existing knowledge transfer methods are mainly implemented through data fine-tuning and model distillation, which may cause the leakage of data privacy or model copyright in intelligent collaborative systems. To address this issue, we propose a secure and robust knowledge transfer framework through stratified-causality distribution adjustment (SCDA) for device-edge-cloud collaborative services. Specifically, a simple yet effective density-based estimation is first employed to obtain …

Hardware-Assisted Live Kernel Function Updating On Intel Platforms, Lei Zhou, Fengwei Zhang, Kevin Leach, Xuhua Ding, Zhenyu Ning, Guojun Wang, Jidong Xiao

Research Collection School Of Computing and Information Systems

Traditional kernel updates such as perfective maintenance and vulnerability patching requires shutting the system down, disrupting continuous execution of applications. Enterprises and researchers have proposed various live updating techniques to patch the kernel with lower downtime to reduce the loss of useful uptime. However, existing kernel live update techniques either rely on specific support from the target OS, or are deployed in virtualized environments (i.e., systems running in virtual machines). In this article we present KShot , a hardware-assisted live and secure kernel function update mechanism for native operating systems. By leveraging x86 SMM and Intel SGX, KShot runs in …

Mitigating Cyber Espionage: A Network Security Strategy Using Notifications, Claire Headland

Williams Honors College, Honors Research Projects

Network security and its mitigation of cyber espionage is paramount to the confidentiality, integrity, and availability of data within the intelligence field. With the advancing efficacy of social engineering to execute cyber espionage attacks, further measures and fail-safe mechanisms have become necessary. If a malicious actor successfully penetrates the network, suspending confidential data transmissions over the compromised network becomes crucial. However, connected users need a platform to receive security notifications and, therefore, need to know that their continued network use compromises more data. This project eliminates this by achieving two primary objectives: designing a multi- layered, hardened, and segmented network …

Recovering Access Control Via Disk Forensics On Low-Level Flash Memory, Caleb J. Rother

Dissertations, Master's Theses and Master's Reports

In the history of access control, nearly every system designed has relied on the operating system (OS) to enforce the access control protocols. However, if the OS (and specifically root access) is compromised, there are few if any solutions that can get users back into their system efficiently. In this work, we have proposed a novel approach that allows secure and efficient rollback of file access control after an adversary compromises the OS and corrupts the access control metadata. Our key observation is that the underlying flash memory typically performs out-of-place updates. Taking advantage of this unique feature, we can …

The Effectiveness Of Cybersecurity Training, Courtney Knight

Electronic Theses & Dissertations (2024 - present)

This study seeks to answer the question of what kinds of cybersecurity training are effective by reviewing the existing literature, analyzing for gaps, and bridging the connection with known learning techniques. The research is exploratory in nature, and is inductive – intending to develop a theory. Additionally, this study seeks to offer a taxonomy of cybersecurity training methods to be evaluated.

This study did not include security operation center (SOC), cyber incident response teams (CIRTs), or other types of advanced cybersecurity professional training. This research specifically focuses on training to improve the average employee and population’s tactical cybersecurity skills.

Several …

Sub-Band Backdoor Attack In Remote Sensing Imagery, Kazi Aminul Islam, Hongyi Wu, Chunsheng Xin, Rui Ning, Liuwan Zhu, Jiang Li

Electrical & Computer Engineering Faculty Publications

Remote sensing datasets usually have a wide range of spatial and spectral resolutions. They provide unique advantages in surveillance systems, and many government organizations use remote sensing multispectral imagery to monitor security-critical infrastructures or targets. Artificial Intelligence (AI) has advanced rapidly in recent years and has been widely applied to remote image analysis, achieving state-of-the-art (SOTA) performance. However, AI models are vulnerable and can be easily deceived or poisoned. A malicious user may poison an AI model by creating a stealthy backdoor. A backdoored AI model performs well on clean data but behaves abnormally when a planted trigger appears in …