Information Security Commons^™

Efficient And Secure Digital Signature Algorithm (Dsa), Nissa Mehibel, M'Hamed Hamadouche

Emirates Journal for Engineering Research

The digital signature is used to ensure the integrity of messages as well as the authentication and non-repudiation of users. Today it has a very important role in information security. Digital signature is used in various fields such as e-commerce and e-voting, health, internet of things (IOT). Many digital signature schemes have been proposed, depending on the computational cost and security level. In this paper, we analyzed a recently proposed digital signature scheme based on the discrete logarithm problem (DLP). Our analysis shows that the scheme is not secure against the repeated random number attack to determine the secret keys …

Static Malware Family Clustering Via Structural And Functional Characteristics, David George, Andre Mauldin, Josh Mitchell, Sufiyan Mohammed, Robert Slater

SMU Data Science Review

Static and dynamic analyses are the two primary approaches to analyzing malicious applications. The primary distinction between the two is that the application is analyzed without execution in static analysis, whereas the dynamic approach executes the malware and records the behavior exhibited during execution. Although each approach has advantages and disadvantages, dynamic analysis has been more widely accepted and utilized by the research community whereas static analysis has not seen the same attention. This study aims to apply advancements in static analysis techniques to demonstrate the identification of fine-grained functionality, and show, through clustering, how malicious applications may be grouped …

Cybersecurity Safeguards: What Cybersecurity Safeguards Could Have Prevented The Intelligence/Data Breach By A Member Of The Air National Guard, Christopher Curtis Royal

Cyber Operations and Resilience Program Graduate Projects

Jack Teixeira, a 21-year-old IT specialist Air National Guard found himself on the wrong side of the US law after sharing what is considered classified and extremely sensitive information about USA's operations and role in Ukraine and Russia war. Like other previous cases of leakage of classified intelligence, the case of Teixeira raises concerns about the weaknesses and vulnerability of federal agencies' IT systems and security protocols governing accessibility to classified documents. Internal leakages of such classified documents hurt national security and can harm the country, especially when such secretive intelligence finds its way into the hands of enemies. Unauthorized …

Crowdfl: Privacy-Preserving Mobile Crowdsensing System Via Federated Learning, Bowen Zhao, Ximeng Liu, Wei-Neng Chen, Robert H. Deng

Research Collection School Of Computing and Information Systems

As an emerging sensing data collection paradigm, mobile crowdsensing (MCS) enjoys good scalability and low deployment cost but raises privacy concerns. In this paper, we propose a privacy-preserving MCS system called CROWDFL by seamlessly integrating federated learning (FL) into MCS. At a high level, in order to protect participants' privacy and fully explore participants' computing power, participants in CROWDFL locally process sensing data via FL paradigm and only upload encrypted training models to the server. To this end, we design a secure aggregation algorithm (SecAgg) through the threshold Paillier cryptosystem to aggregate training models in an encrypted form. Also, to …

Reinforcing Digital Trust For Cloud Manufacturing Through Data Provenance Using Ethereum Smart Contracts, Trupti Narayan Rane

Engineering Management & Systems Engineering Theses & Dissertations

Cloud Manufacturing(CMfg) is an advanced manufacturing model that caters to fast-paced agile requirements (Putnik, 2012). For manufacturing complex products that require extensive resources, manufacturers explore advanced manufacturing techniques like CMfg as it becomes infeasible to achieve high standards through complete ownership of manufacturing artifacts (Kuan et al., 2011). CMfg, with other names such as Manufacturing as a Service (MaaS) and Cyber Manufacturing (NSF, 2020), addresses the shortcoming of traditional manufacturing by building a virtual cyber enterprise of geographically distributed entities that manufacture custom products through collaboration.

With manufacturing venturing into cyberspace, Digital Trust issues concerning product quality, data, and intellectual …

Cyber Attack Surface Mapping For Offensive Security Testing, Douglas Everson

All Dissertations

Security testing consists of automated processes, like Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST), as well as manual offensive security testing, like Penetration Testing and Red Teaming. This nonautomated testing is frequently time-constrained and difficult to scale. Previous literature suggests that most research is spent in support of improving fully automated processes or in finding specific vulnerabilities, with little time spent improving the interpretation of the scanned attack surface critical to nonautomated testing. In this work, agglomerative hierarchical clustering is used to compress the Internet-facing hosts of 13 representative companies as collected by the Shodan search …

Proxy Hunting: Understanding And Characterizing Proxy-Based Upgradeable Smart Contracts In Blockchains, William E Iii Bodell, Sajad Meisami, Yue Duan

Research Collection School Of Computing and Information Systems

Upgradeable smart contracts (USCs) have become a key trend in smart contract development, bringing flexibility to otherwise immutable code. However, they also introduce security concerns. On the one hand, they require extensive security knowledge to implement in a secure fashion. On the other hand, they provide new strategic weapons for malicious activities. Thus, it is crucial to fully understand them, especially their security implications in the real-world. To this end, we conduct a large-scale study to systematically reveal the status quo of USCs in the wild. To achieve our goal, we develop a complete USC taxonomy to comprehensively characterize the …

Decompiling X86 Deep Neural Network Executables, Zhibo Liu, Yuanyuan Yuan, Shuai Wang, Xiaofei Xie, Lei Ma

Research Collection School Of Computing and Information Systems

Due to their widespread use on heterogeneous hardware devices, deep learning (DL) models are compiled into executables by DL compilers to fully leverage low-level hardware primitives. This approach allows DL computations to be undertaken at low cost across a variety of computing platforms, including CPUs, GPUs, and various hardware accelerators. We present BTD (Bin to DNN), a decompiler for deep neural network (DNN) executables. BTD takes DNN executables and outputs full model specifications, including types of DNN operators, network topology, dimensions, and parameters that are (nearly) identical to those of the input models. BTD delivers a practical framework to process …

Multi-Granularity Detector For Vulnerability Fixes, Truong Giang Nguyen, Cong, Thanh Le, Hong Jin Kang, Ratnadira Widyasari, Chengran Yang, Zhipeng Zhao, Bowen Xu, Jiayuan Zhou, Xin Xia, Ahmed E. Hassan, David Lo, David Lo

Research Collection School Of Computing and Information Systems

With the increasing reliance on Open Source Software, users are exposed to third-party library vulnerabilities. Software Composition Analysis (SCA) tools have been created to alert users of such vulnerabilities. SCA requires the identification of vulnerability-fixing commits. Prior works have proposed methods that can automatically identify such vulnerability-fixing commits. However, identifying such commits is highly challenging, as only a very small minority of commits are vulnerability fixing. Moreover, code changes can be noisy and difficult to analyze. We observe that noise can occur at different levels of detail, making it challenging to detect vulnerability fixes accurately. To address these challenges and …

A Certificateless Designated Verifier Sanitizable Signature, Yonghua Zhan, Bixia Yi, Yang Yang, Renjie He, Rui Shi

Research Collection School Of Computing and Information Systems

Sanitizable Signature is a digital signature variant that enables modification operations, allowing sanitizers to alter the signed data in a regulated manner without requiring any interaction with the original signer. It is widely used in scenarios such as healthcare data privacy protection, social networks, secure routing, etc. In existing sanitizable signature schemes, anyone can verify the validity and authenticity of the sanitized message, which results in costly certificate management overhead or complicated key escrow problems. To address these challenges, a designated verifier certificateless sanitizable signature scheme is proposed. This scheme introduces the concept of a designated verifier into sanitizable signatures, …

On Phishing: Proposing A Host-Based Multi-Layer Passive/Active Anti-Phishing Approach Combating Counterfeit Websites, Wesam Harbi Fadheel

Dissertations

Phishing is the starting point of most cyberattacks, mainly categorized as Email, Websites, Social Networks, Phone calls (Vishing), and SMS messaging (Smishing). Phishing refers to an attempt to collect sensitive data, typically in the form of usernames, passwords, credit card numbers, bank account information, etc., or other crucial facts, intending to use or sell the information obtained. Similar to how a fisherman uses bait to catch a fish, an attacker will pose as a trustworthy source to attract and deceive the victim.

This study explores the efficacy of host-side APT (Anti-Phishing Techniques) based onWebsite features like Lexical, Host-Based, or Content-Based …

Future Trends And Directions For Secure Infrastructure Architecture In The Education Sector: A Systematic Review Of Recent Evidence, Isaac Atta Senior Ampofo, Isaac Atta Junior Ampofo

Journal of Research Initiatives

The most efficient approach to giving large numbers of students’ access to computational resources is through a data center. A contemporary method for building the data center's computer infrastructure is the software-defined model, which enables user tasks to be processed in a reasonable amount of time and at a reasonable cost. The researcher examines potential directions and trends for a secured infrastructure design in this article. Additionally, interoperable, highly reusable modules that can include the newest trends in the education industry are made possible by cloud-based educational software. The Reference Architecture for University Education System Using AWS Services is presented …

Examination Of Cybersecurity Technologies, Practices, Challenges, And Wish List In K-12 School Districts, Florence Martin, Julie Bacak, Erik Jon Byker, Weichao Wang, Jonathan Wagner, Lynn Ahlgrim-Delzell

Journal of Cybersecurity Education, Research and Practice

With the growth in digital teaching and learning, there has been a sharp rise in the number of cybersecurity attacks on K-12 school networks. This has demonstrated a need for security technologies and cybersecurity education. This study examined security technologies used, effective security practices, challenges, concerns, and wish list of technology leaders in K-12 settings. Data collected from 23 district websites and from interviews with 12 district technology leaders were analyzed. Top security practices included cloud-based technologies, segregated network/V-LAN, two-factor authentication, limiting access, and use of Clever or Class Link. Top challenges included keeping users informed, lack of buy-in from …

Cyberbullying: Senior Prospective Teachers’ Coping Knowledge And Strategies, Kürşat Arslan, İnan Aydın

Journal of Cybersecurity Education, Research and Practice

This study aimed to determine senior prospective teachers’ coping knowledge and strategies for cyberbullying in terms of demographic variables. The sample consisted of 471 prospective teachers (324 female and 147 male) studying in the 4th grade in Dokuz Eylül University Buca Education Faculty in Izmir in the 2019-2020 academic year. It was a quantitative study using a causal-comparative research design to find out whether prospective teachers’ coping knowledge differed by independent variables. The "Coping with Cyberbullying Scale" developed by Koç et al. (2016) was employed to discover prospective teachers’ coping strategies for cyberbullying. A "Personal Information" form was also prepared …

A Systematic Mapping Study On Gamification Applications For Undergraduate Cybersecurity Education, Sherri Weitl-Harms, Adam Spanier, John Hastings, Matthew Rokusek

Journal of Cybersecurity Education, Research and Practice

Gamification in education presents a number of benefits that can theoretically facilitate higher engagement and motivation among students when learning complex, technical concepts. As an innovative, high-potential educational tool, many educators and researchers are attempting to implement more effective gamification into undergraduate coursework. Cyber Security Operations (CSO) education is no exception. CSO education traditionally requires comprehension of complex concepts requiring a high level of technical and abstract thinking. By properly applying gamification to complex CSO concepts, engagement in students should see an increase. While an increase is expected, no comprehensive study of CSO gamification applications (GA) has yet been undertaken …

Editorial - 2023 - 1, Hossain Shahriar, Herbert J. Mattord, Michael E. Whitman

Journal of Cybersecurity Education, Research and Practice

No abstract provided.

Sociocultural Barriers For Female Participation In Stem: A Case Of Saudi Women In Cybersecurity, Alanoud Aljuaid, Xiang Michelle Liu

Journal of Cybersecurity Education, Research and Practice

The participation of women in Science, Technology, Engineering, and Mathematics (STEM) workforces is overwhelmingly low as compared to their male counterparts. The low uptake of cybersecurity careers has been documented in the previous studies conducted in the contexts of the West and Eastern worlds. However, most of the past studies mainly covered the Western world leaving more knowledge gaps in the context of Middle Eastern countries such as Saudi Arabia. Thus, to fill the existing knowledge gaps, the current study focused on women in Saudi Arabia. The aim of the study was to investigate the factors behind the underrepresentation of …

Compete To Learn: Toward Cybersecurity As A Sport, Tj Oconnor, Dane Brown, Jasmine Jackson, Bryson Payne, Suzanna Schmeelk

Journal of Cybersecurity Education, Research and Practice

To support the workforce gap of skilled cybersecurity professionals, gamified pedagogical approaches for teaching cybersecurity have exponentially grown over the last two decades. During this same period, e-sports developed into a multi-billion dollar industry and became a staple on college campuses. In this work, we explore the opportunity to integrate e-sports and gamified cybersecurity approaches into the inaugural US Cyber Games Team. During this tenure, we learned many lessons about recruiting, assessing, and training cybersecurity teams. We share our approach, materials, and lessons learned to serve as a model for fielding amateur cybersecurity teams for future competition.

How Effective Are Seta Programs Anyway: Learning And Forgetting In Security Awareness Training, David Sikolia, David Biros, Tianjian Zhang

Journal of Cybersecurity Education, Research and Practice

Prevalent security threats caused by human errors necessitate security education, training, and awareness (SETA) programs in organizations. Despite strong theoretical foundations in behavioral cybersecurity, field evidence on the effectiveness of SETA programs in mitigating actual threats is scarce. Specifically, with a broad range of cybersecurity knowledge crammed into in a single SETA session, it is unclear how effective different types of knowledge are in mitigating human errors in a longitudinal setting. his study investigates how knowledge gained through SETA programs affects human errors in cybersecurity to fill the longitudinal void. In a baseline experiment, we establish that SETA programs reduce …

Anonymity And Gender Effects On Online Trolling And Cybervictimization, Gang Lee, Annalyssia Soonah

Journal of Cybersecurity Education, Research and Practice

The purpose of this study was to investigate the effects of the anonymity of the internet and gender differences in online trolling and cybervictimization. A sample of 151 college students attending a southeastern university completed a survey to assess their internet activities and online trolling and cybervictimization. Multivariate analyses of logistic regression and ordinary least squares regression were used to analyze online trolling and cybervictimization. The results indicated that the anonymity measure was not a significant predictor of online trolling and cybervictimization. Female students were less likely than male students to engage in online trolling, but there was no gender …