Information Security Commons^™

Side-Channel Analysis On Post-Quantum Cryptography Algorithms, Tristen Teague

Computer Science and Computer Engineering Undergraduate Honors Theses

The advancements of quantum computers brings us closer to the threat of our current asymmetric cryptography algorithms being broken by Shor's Algorithm. NIST proposed a standardization effort in creating a new class of asymmetric cryptography named Post-Quantum Cryptography (PQC). These new algorithms will be resistant against both classical computers and sufficiently powerful quantum computers. Although the new algorithms seem mathematically secure, they can possibly be broken by a class of attacks known as side-channels attacks (SCA). Side-channel attacks involve exploiting the hardware that the algorithm runs on to figure out secret values that could break the security of the system. …

Ransomware And Malware Sandboxing, Byron Denham

Computer Science and Computer Engineering Undergraduate Honors Theses

The threat of ransomware that encrypts data on a device and asks for payment to decrypt the data affects individual users, businesses, and vital systems including healthcare. This threat has become increasingly more prevalent in the past few years. To understand ransomware through malware analysis, care must be taken to sandbox the ransomware in an environment that allows for a detailed and comprehensive analysis while also preventing it from being able to further spread. Modern malware often takes measures to detect whether it has been placed into an analysis environment to prevent examination. In this work, several notable pieces of …

Comparative Study Of Snort 3 And Suricata Intrusion Detection Systems, Cole Hoover

Computer Science and Computer Engineering Undergraduate Honors Theses

Network Intrusion Detection Systems (NIDS) are one layer of defense that can be used to protect a network from cyber-attacks. They monitor a network for any malicious activity and send alerts if suspicious traffic is detected. Two of the most common open-source NIDS are Snort and Suricata. Snort was first released in 1999 and became the industry standard. The one major drawback of Snort has been its single-threaded architecture. Because of this, Suricata was released in 2009 and uses a multithreaded architecture. Snort released Snort 3 last year with major improvements from earlier versions, including implementing a new multithreaded architecture …

Detecting The Intensity Of Denial-Of-Service Cyber Attacks Using Supervised Machine Learning, Abigail Hubbard

Undergraduate Honors Theses

Denial-of-Service (DoS) attacks are aimed at shutting a machine or network down to block users from accessing it. These attacks can be difficult to detect and can cost millions in damages or lost earnings. Since the first DoS attack occurred in 1999, the way DoS attacks have been launched has become more complicated, making them more elusive and harder to detect. The first step to detect and mitigate a DoS attack is for a system to identify the malicious traffic.

In this experiment, we aim to identify the malicious traffic within ten seconds. To do this the project was divided …

A Dark Web Pharma Framework For A More Efficient Investigation Of Dark Web Covid-19 Vaccine Products., Francisca Afua Opoku-Boateng

Masters Theses & Doctoral Dissertations

Globally, as the COVID-19 pandemic persists, it has not just imposed a significant impact on the general well-being of individuals, exposing them to unprecedented financial hardships and online information deception. However, it has also forced consumers, buyers, and suppliers to look toward a darkened economic world – the Dark Web world – a sinister complement to the internet, driven by financial gains, where illegal goods and services are advertised sold. As the Dark Web gains an increase in recognition by normal web users during this pandemic, how to perform cybercrime investigations on the Dark Web becomes challenging for manufacturers, investigators, …

An Application Of Machine Learning To Analysis Of Packed Mac Malware, Kimo Bumanglag

Masters Theses & Doctoral Dissertations

The macOS operating system is increasingly targeted by malware. Software written for macOS, both benign and malicious, is in the Mach-O executable format. Malware authors may frustrate analysts through obfuscation methods such as packing. The field of malware research on Windows is well-established but is less so on the macOS platform. Thus far, no research has been identified that studies how machine learning can be used to detected packed Mach-O malware. This research applies supervised machine learning techniques to the classification of packed Mach-O malware. This research will answer three research questions. First, whether machine learning can classify packed Mach-O …

Benchmarking Library Recognition In Tweets, Ting Zhang, Divya Prabha Chandrasekaran, Ferdian Thung, David Lo

Research Collection School Of Computing and Information Systems

Software developers often use social media (such as Twitter) to shareprogramming knowledge such as new tools, sample code snippets,and tips on programming. One of the topics they talk about is thesoftware library. The tweets may contain useful information abouta library. A good understanding of this information, e.g., on thedeveloper’s views regarding a library can be beneficial to weigh thepros and cons of using the library as well as the general sentimentstowards the library. However, it is not trivial to recognize whethera word actually refers to a library or other meanings. For example,a tweet mentioning the word “pandas" may refer to …

Efficient Encrypted Data Search With Expressive Queries And Flexible Update, Jianting Ning, Jiageng Chen, Kaitai Liang, Joseph K. Liu, Chunhua Su, Qianhong Wu

Research Collection School Of Computing and Information Systems

Outsourcing encrypted data to cloud servers that has become a prevalent trend among Internet users to date. There is a long list of advantages on data outsourcing, such as the reduction cost of local data management. How to securely operate encrypted data (remotely), however, is the top-rank concern over data owner. Liang et al. proposed a novel encrypted cloud-based data share and search system without loss of privacy. The system allows users to flexibly search and share encrypted data as well as updating keyword field. However, the search complexity of the system is of extreme inefficiency, O(nd), where d is …

Natural Attack For Pre-Trained Models Of Code, Zhou Yang, Jieke Shi, Junda He, David Lo

Research Collection School Of Computing and Information Systems

Pre-trained models of code have achieved success in many important software engineering tasks. However, these powerful models are vulnerable to adversarial attacks that slightly perturb model inputs to make a victim model produce wrong outputs. Current works mainly attack models of code with examples that preserve operational program semantics but ignore a fundamental requirement for adversarial example generation: perturbations should be natural to human judges, which we refer to as naturalness requirement. In this paper, we propose ALERT (Naturalness Aware Attack), a black-box attack that adversarially transforms inputs to make victim models produce wrong outputs. Different from prior works, this …

Optimized Damage Assessment And Recovery Through Data Categorization In Critical Infrastructure System., Shruthi Ramakrishnan

Graduate Theses and Dissertations

Critical infrastructures (CI) play a vital role in majority of the fields and sectors worldwide. It contributes a lot towards the economy of nations and towards the wellbeing of the society. They are highly coupled, interconnected and their interdependencies make them more complex systems. Thus, when a damage occurs in a CI system, its complex interdependencies make it get subjected to cascading effects which propagates faster from one infrastructure to another resulting in wide service degradations which in turn causes economic and societal effects. The propagation of cascading effects of disruptive events could be handled efficiently if the assessment and …

Sanitizable Access Control System For Secure Cloud Storage Against Malicious Data Publishers, Willy Susilo, Peng Jiang, Jianchang Lai, Fuchun Guo, Guomin Yang, Robert H. Deng

Research Collection School Of Computing and Information Systems

Cloud computing is considered as one of the most prominent paradigms in the information technology industry, since it can significantly reduce the costs of hardware and software resources in computing infrastructure. This convenience has enabled corporations to efficiently use the cloud storage as a mechanism to share data among their employees. At the first sight, by merely storing the shared data as plaintext in the cloud storage and protect them using an appropriate access control would be a nice solution. This is assuming that the cloud is fully trusted for not leaking any information, which is impractical as the cloud …

A Machine Learning Approach For Reconnaissance Detection To Enhance Network Security, Rachel Bakaletz

Electronic Theses and Dissertations

Before cyber-crime can happen, attackers must research the targeted organization to collect vital information about the target and pave the way for the subsequent attack phases. This cyber-attack phase is called reconnaissance or enumeration. This malicious phase allows attackers to discover information about a target to be leveraged and used in an exploit. Information such as the version of the operating system and installed applications, open ports can be detected using various tools during the reconnaissance phase. By knowing such information cyber attackers can exploit vulnerabilities that are often unique to a specific version.

In this work, we develop an …

College Of Education Filemaker Extraction And End-User Database Development, Andrew Tran

Electronic Theses, Projects, and Dissertations

The College of Education (CoE) at the California State University San Bernardino (CSUSB) developed a system to keep track of both state and national accreditation requirements using FileMaker 5, a database system. This accreditation data is crucial for reporting and record-keeping for the CSU Chancellor’s Office as well as the State of California. However, the database system was developed several decades ago, and software support has long since been dropped, causing the CoE’s legacy accreditation data to be at risk of being lost should the software or hardware suffer permanent failure. The purpose of this project was to perform extraction …

Probabilistic Path Prioritization For Hybrid Fuzzing, Lei Zhao, Pengcheng Cao, Yue Duan, Heng Yin, Jifeng Xuan

Research Collection School Of Computing and Information Systems

Hybrid fuzzing that combines fuzzing and concolic execution has become an advanced technique for software vulnerability detection. Based on the observation that fuzzing and concolic execution are complementary in nature, state-of-the-art hybrid fuzzing systems deploy “optimal concolic testing” and “demand launch” strategies. Although these ideas sound intriguing, we point out several fundamental limitations in them, due to unrealistic or oversimplified assumptions. Further, we propose a novel “discriminative dispatch” strategy and design a probabilistic hybrid fuzzing system to better utilize the capability of concolic execution. Specifically, we design a Monte Carlo-based probabilistic path prioritization model to quantify each path’s difficulty, and …

Smile: Secure Memory Introspection For Live Enclave, Lei Zhou, Xuhua Ding, Zhang Fengwei

Research Collection School Of Computing and Information Systems

SGX enclaves prevent external software from accessing their memory. This feature conflicts with legitimate needs for enclave memory introspection, e.g., runtime stack collection on an enclave under a return-oriented-programming attack. We propose SMILE for enclave owners to acquire live enclave contents with the assistance of a semi-trusted agent installed by the host platform’s vendor as a plug-in of the System Management Interrupt handler. SMILE authenticates the enclave under introspection without trusting the kernel nor depending on the SGX attestation facility. SMILE is enclave security preserving as breaking of SMILE does not undermine enclave security. It allows a cloud server to …

Linkbreaker: Breaking The Backdoor-Trigger Link In Dnns Via Neurons Consistency Check, Zhenzhu Chen, Shang Wang, Anmin Fu, Yansong Gao, Shui Yu, Robert H. Deng

Research Collection School Of Computing and Information Systems

Backdoor attacks cause model misbehaving by first implanting backdoors in deep neural networks (DNNs) during training and then activating the backdoor via samples with triggers during inference. The compromised models could pose serious security risks to artificial intelligence systems, such as misidentifying 'stop' traffic sign into '80km/h'. In this paper, we investigate the connection characteristic between the backdoor and the trigger in DNNs and observe the fact that the backdoor is implanted via establishing a link between a cluster of neurons, representing the backdoor, and the triggers. Based on this observation, we design LinkBreaker, a new generic scheme for defending …

Enhancing System Security Using Dynamic Hardware, Sydney L. Davis

Graduate Theses and Dissertations (2019 - present)

Within the ever-advancing field of computing, there is significant research into the many facets of cyber security. However, there is very little research to support the concept of using a Field Programmable Gate Array (FPGA) to increase the security of a system. While its most common use is to provide efficiency and speedup of processes, this research considers the use of an FPGA to mitigate vulnerabilities in both software and hardware. This paper proposes circuit variance within an FPGA as a method of Moving Target Defense (MTD) and investigates its effect on side-channels. We hypothesize that although the functionality of …

“Lasso The Moon? Is It Possible? What About Hack The Moon? Today’S International Framework For Activities On The Moon”, Diane M. Janosek, Armando Seay, Josa P. Natera

Military Cyber Affairs

The global interest in the moon and outer space continues to skyrocket. The current U.S. commercial investment in space is $350 billion annually, and it is expected to grow to $1 Trillion or more by 2040. The U.S. military investment in space defense and research likewise continues to grow, with the total investment amount remaining classified. With the frequent activity in space, as well as concerns about attacks to US space assets to and from space, the U.S, created the United States Space Command and its Space Force. With private space travel, nanosatellites, lunar exploration, and the proliferation of space …

Hypergaming For Cyber: Strategy For Gaming A Wicked Problem, Joshua A. Sipper

Military Cyber Affairs

Cyber as a domain and battlespace coincides with the defined attributes of a “wicked problem” with complexity and inter-domain interactions to spare. Since its elevation to domain status, cyber has continued to defy many attempts to explain its reach, importance, and fundamental definition. Corresponding to these intricacies, cyber also presents many interlaced attributes with other information related capabilities (IRCs), namely electromagnetic warfare (EW), information operations (IO), and intelligence, surveillance, and reconnaissance (ISR), within an information warfare (IW) construct that serves to add to its multifaceted nature. In this cyber analysis, the concept of hypergaming will be defined and discussed in …

Framework Of Hardware Trojan Detection Leveraging Structural Checking Tool, Rafael Dacanay Del Carmen

Graduate Theses and Dissertations

Since there is a significant demand for obtaining third-party soft Intellectual Property (IP) by first-party integrated circuit (IC) vendors, it is becoming easier for adversaries to insert malicious logic known as hardware Trojans into designs. Due to this, vendors need to find ways to screen the third-party IPs for possible security threats and then mitigate them. The development of the Structural Checking (SC) tool provides a solution to this issue. This tool analyzes the structure of an unknown soft IP design and creates a network of all the signals within the design and how they are connected to each other. …