Information Security Commons^™

Trace Dna Detection Using Diamond Dye: A Recovery Technique To Yield More Dna, Leah Davis

Master's Theses

This study aspires to find a new screening approach to trace DNA recovery techniques to yield a higher quantity of trace DNA from larger items of evidence. It takes the path of visualizing trace DNA on items of evidence with potential DNA so analysts can swab a more localized area rather than attempting to recover trace DNA through the general swabbing technique currently used for trace DNA recovery. The first and second parts consisted of observing trace DNA interaction with Diamond Dye on porous and non-porous surfaces.

The third part involved applying the Diamond Dye solution by spraying it onto …

Low-Complexity Three-Dimensional Aoa-Cross Geometric Center Localization Methods Via Multi-Uav Network, Baihua Shi, Yifan Li, Guilu Wu, Riqing Chen, Shihao Yan, Feng Shu

Research outputs 2022 to 2026

The angle of arrival (AOA) is widely used to locate a wireless signal emitter in unmanned aerial vehicle (UAV) localization. Compared with received signal strength (RSS) and time of arrival (TOA), AOA has higher accuracy and is not sensitive to the time synchronization of the distributed sensors. However, there are few works focusing on three-dimensional (3-D) scenarios. Furthermore, although the maximum likelihood estimator (MLE) has a relatively high performance, its computational complexity is ultra-high. Therefore, it is hard to employ it in practical applications. This paper proposed two center of inscribed sphere-based methods for 3-D AOA positioning via multiple UAVs. …

An Application Risk Assessment Of Werner Enterprises, Nathan Andres

Theses/Capstones/Creative Projects

Risk assessments provide a systematic approach to identifying potential risks that could negatively impact an organization’s operations, financial performance, and reputation. Using a risk assessment, companies can evaluate potential risks and vulnerabilities, prioritize them based on their potential impact, and develop strategies to manage and address these risks effectively.

Werner Enterprises Inc. is a nationally known trucking company headquartered in Omaha, Nebraska. Our cybersecurity capstone project motivation was to partner with Werner to produce an assessment of known application risks in a functional way that can be repeated for all of Werner’s applications. To achieve this, we created a risk …

Rbac Attack Exposure Auditor. Tracking User Risk Exposure Per Role-Based Access Control Permissions, Adelaide Damrau

Undergraduate Honors Theses

Access control models and implementation guidelines for determining, provisioning, and de-provisioning user permissions are challenging due to the differing approaches, unique for each organization, the lack of information provided by case studies concerning the organization’s security policies, and no standard means of implementation procedures or best practices. Although there are multiple access control models, one stands out, role-based access control (RBAC). RBAC simplifies maintenance by enabling administrators to group users with similar permissions. This approach to managing user permissions supports the principle of least privilege and separation of duties, which are needed to ensure an organization maintains acceptable user access …

Fine-Grained Commit-Level Vulnerability Type Prediction By Cwe Tree Structure, Shengyi Pan, Lingfeng Bao, Xin Xia, David Lo, Shanping Li

Research Collection School Of Computing and Information Systems

Identifying security patches via code commits to allow early warnings and timely fixes for Open Source Software (OSS) has received increasing attention. However, the existing detection methods can only identify the presence of a patch (i.e., a binary classification) but fail to pinpoint the vulnerability type. In this work, we take the first step to categorize the security patches into fine-grained vulnerability types. Specifically, we use the Common Weakness Enumeration (CWE) as the label and perform fine-grained classification using categories at the third level of the CWE tree. We first formulate the task as a Hierarchical Multi-label Classification (HMC) problem, …

Design, Modeling, And Simulation Of Secure X.509 Certificate Revocation, Sai Medury

Masters Theses and Doctoral Dissertations

TLS communication over the internet has risen rapidly in the last seven years (2015--2022), and there were over 156M active SSL certificates in 2022. The state-of-the-art Public Key Infrastructure (PKI), encompassing protocols, computational resources, and digital certificates, has evolved for 24 years to become the de-facto choice for encrypted communication over the Internet even on newer platforms such as mobile devices and Internet-of-Things (IoT) (despite being low powered with computational constraints). However, certificate revocation is one sub-protocol in TLS communication that fails to meet the rising scalability demands and remains open to exploitation. In this dissertation, the standard for X.509 …

The Effect Of Cybersecurity Training On Government Employee’S Knowledge Of Cybersecurity Issues And Practices, Juan Jaime Saldana Ii

Theses and Dissertations

There is an ever-pressing need for cybersecurity awareness and implementation of learning strategies in the workplace to mitigate the increased threat posed by cyber-attacks and exacerbated by an untrained workforce. The lack of cybersecurity knowledge amongst government employees has increased to critical levels due to the amount of sensitive information their agencies are responsible for. The digital compromise of a government entity often leads to a compromise of constituent data along with the disruption of public services (Axelrod, 2019; Yazdanpanahi, 2021). The need for awareness is further complicated by agencies looking to cater to a digital culture looking for a …

A Framework For Identifying Malware Threat Distribution On The Dark Web, Shelby Caldwell

Graduate Theses and Dissertations (2019 - present)

The Dark Web is an ever-growing phenomenon that has not been deeply explored. It is no secret that in recent years, malware has become a powerful threat to technology users. The Dark Web is known for supporting anonymity and secure connections for private interactions. Over the years, it has become a rich environment for displaying trends, details, and indicators of emerging malware threats. Through the application of data science and open-source intelligence techniques, trends in malware distribution can be studied. In this research, we create a framework for helping identify malware threat distribution patterns. We examine this type of Dark …

Risk Assessment Framework For Evaluation Of Cybersecurity Threats And Vulnerabilities In Medical Devices, Maureen S. Van Devender

Graduate Theses and Dissertations (2019 - present)

Medical devices are vulnerable to cybersecurity exploitation and, while they can provide improvements to clinical care, they can put healthcare organizations and their patients at risk of adverse impacts. Evidence has shown that the proliferation of devices on medical networks present cybersecurity challenges for healthcare organizations due to their lack of built-in cybersecurity controls and the inability for organizations to implement security controls on them. The negative impacts of cybersecurity exploitation in healthcare can include the loss of patient confidentiality, risk to patient safety, negative financial consequences for the organization, and loss of business reputation. Assessing the risk of vulnerabilities …

Iot Health Devices: Exploring Security Risks In The Connected Landscape, Abasi-Amefon Obot Affia, Hilary Finch, Woosub Jung, Issah Abubakari Samori, Lucas Potter, Xavier-Lewis Palmer

School of Cybersecurity Faculty Publications

The concept of the Internet of Things (IoT) spans decades, and the same can be said for its inclusion in healthcare. The IoT is an attractive target in medicine; it offers considerable potential in expanding care. However, the application of the IoT in healthcare is fraught with an array of challenges, and also, through it, numerous vulnerabilities that translate to wider attack surfaces and deeper degrees of damage possible to both consumers and their confidence within health systems, as a result of patient-specific data being available to access. Further, when IoT health devices (IoTHDs) are developed, a diverse range of …

Gaslight: Attacking Hard-Label Black-Box Classifiers Via Deep Reinforcement Learning, Rajat Sethi

All Theses

Through artificial intelligence, algorithms can classify arrays of data, such as images or videos, into a predefined set of categories. With enough labeled data, a classifier can analyze an input’s components and calculate confidence scores for each category. However, machine learning relies heavily on approximation, which allows attackers to exploit classifiers by providing adversarial
examples. Specifically, attackers can modify their input so that the victim classifier cannot correctly label it, while a human observer would be unable to notice the difference.
This thesis proposes Gaslight, a system that uses deep reinforcement learning to generate adversarial examples against a victim classifier. …

Individual Differences In Vulnerability To Phishing, Fake News, And Vishing, Jeff Black

All Theses

Digital deception, such as phishing emails, scam phone calls, and fake news, poses a threat to anyone using digital devices. Research on digital deception often points to individual differences like age, cognitive impulsivity, and digital literacy, but has only investigated different types of digital deception independent of each other. Therefore, it is unclear whether users vulnerable to one type of deception are also vulnerable to others, and why. The present research examined relationships between vulnerability to different types of deception, and how this vulnerability is associated with common individual differences like age, cognitive impulsivity, digital literacy, and gullibility, and exploratory …

Towards Privacy-Preserving Social Media Networks: Protecting The Facial Privacy Of Images Uploaded On Social Media, Ahsi Lo

Theses and Dissertations

Since the 2000s, social media has allowed individuals the ability to communicate online. As the popularity of social media increased, the sharing of information such as pictures increased as well. Recently, there have been privacy concerns about the information shared online such as cases where third parties were able to gain access to users’ information without being given explicit access through scraping or other means. When user images are scraped from social media, there is a risk that these individuals can be identified o✏ine. Bystanders, who may be captured in images also run this risk of identification. This research investigates …

Graphprompt: Unifying Pre-Training And Downstream Tasks For Graph Neural Networks, Zemin Liu, Xingtong Yu, Yuan Fang, Xinming Zhang

Research Collection School Of Computing and Information Systems

Graphs can model complex relationships between objects, enabling a myriad of Web applications such as online page/article classification and social recommendation. While graph neural networks (GNNs) have emerged as a powerful tool for graph representation learning, in an end-to-end supervised setting, their performance heavily relies on a large amount of task-specific supervision. To reduce labeling requirement, the "pre-train, fine-tune"and "pre-train, prompt"paradigms have become increasingly common. In particular, prompting is a popular alternative to fine-tuning in natural language processing, which is designed to narrow the gap between pre-training and downstream objectives in a task-specific manner. However, existing study of prompting on …

Colefunda: Explainable Silent Vulnerability Fix Identification, Jiayuan Zhou, Michael Pacheco, Jinfu Chen, Xing Hu, Xin Xia, David Lo, Ahmed E. Hassan

Research Collection School Of Computing and Information Systems

It is common practice for OSS users to leverage and monitor security advisories to discover newly disclosed OSS vulnerabilities and their corresponding patches for vulnerability remediation. It is common for vulnerability fixes to be publicly available one week earlier than their disclosure. This gap in time provides an opportunity for attackers to exploit the vulnerability. Hence, OSS users need to sense the fix as early as possible so that the vulnerability can be remediated before it is exploited. However, it is common for OSS to adopt a vulnerability disclosure policy which causes the majority of vulnerabilities to be fixed silently, …

Premium Wireless, Dakota Burkhart, Andrew Clark, Garrett Kenney, Brandon Monroe

ATU Scholars Symposium

Our work implements an inventory system and appointment system for the Premium Wireless phone company. It includes separate views for employees to manage inventory and view appointments for the day and the near future and allows customers to view all current inventory and set an appointment.

Analysis Of Honeypots In Detecting Tactics, Techniques, And Procedure (Ttp) Changes In Threat Actors Based On Source Ip Address, Carson Reynolds, Andy Green

Symposium of Student Scholars

The financial and national security impacts of cybercrime globally are well documented. According to the 2020 FBI Internet Crime Report, financially motivated threat actors committed 86% of reported breaches, resulting in a total loss of approximately $4.1 billion in the United States alone. In order to combat this, our research seeks to determine if threat actors change their tactics, techniques, and procedures (TTPs) based on the geolocation of their target’s IP address. We will construct a honeypot network distributed across multiple continents to collect attack data from geographically separate locations concurrently to answer this research question. We will configure the …

The Impact Of Artificial Intelligence On The Cybersecurity Industry, Lindsey Shearstone

Honors Projects in Information Systems and Analytics

As our world becomes more digitalized, cyber criminals have an increasing landscape to launch their attacks. Developments in Artificial Intelligence are being used both to attack and defend networks, therefore, what is the next step for cybersecurity companies when it comes to beating these criminals? A study was conducted that utilizes previous literature sources written on the topic of Artificial Intelligence (AI) in the cybersecurity industry. In addition, the insights of professionals in the industry today are included through a survey and interviews to dive into the details of this battle and what lays in its future. The purpose of …

Visual Art In The Age Of Ai, Roshnica Gurung

Cybersecurity Undergraduate Research Showcase

Artists and researchers have been deeply interested in using AI programs that generate art for quite some time now. As a result, there have been many advancements in making AI more accessible and easier to use for the public. This is because AI is not just for business anymore. Nowadays an individual without a college degree with even the slightest interest in art can go on a website like Stable Diffusion and create an artistic image using a text prompt in a quick couple minutes. The only limit is your imagination- and your internet’s stability. This accessibility was a huge …

Assessing The Frequency And Severity Of Malware Attacks: An Exploratory Analysis Of The Advisen Cyber Loss Dataset, Ahmed M. Abdelmagid, Farshid Javadnejad, C. Ariel Pinto, Michael K. Mcshane, Rafael Diaz, Elijah Gartell

Modeling, Simulation and Visualization Student Capstone Conference

In today's business landscape, cyberattacks present a significant threat that can lead to severe financial losses and damage to a company's reputation. To mitigate this risk, it is essential for stakeholders to have an understanding of the latest types and patterns of cyberattacks. The primary objective of this research is to provide this knowledge by utilizing the Advisen cyber loss dataset, which comprises over 137,000 cyber incidents that occurred across various industry sectors from 2013 to 2020. By using text mining techniques, this paper will conduct an exploratory data analysis to identify the most common types of malware, including ransomware. …