Information Security Commons^™

Dataset Evaluation For Data Trading Using Expected Loss And Homomorphic Encryption, Minsung Joo

Senior Honors Papers / Undergraduate Theses

Supervised machine learning suffers from the ``garbage-in garbage-out" phenomenon where the performance of a model is limited by the quality of the data. While a myriad of data is collected every second, there is no general rigorous method of evaluating the quality of a given dataset. This hinders fair pricing of data in scenarios where a buyer may look to buy data for use with machine learning. In this work, I propose using the expected loss corresponding to a dataset as a measure of its quality, relying on Bayesian methods for uncertainty quantification. Furthermore, I present a secure multi-party computation …

Press A To Jump: Design Strategies For Video Game Learnability, Lev Poretski, Anthony Tang

Research Collection School Of Computing and Information Systems

Learnability is a core aspect of software usability. Video games are not an exception, as game designers need to teach players how to play their creations. We analyzed 40 contemporary video games to identify how video games approach learning experiences. We found that games have advanced far beyond using simple tutorials or demonstration screens and adopt a range of repeatable and reusable design strategies using visual cues to facilitate learning. We provide a detailed descriptive framework of these design strategies, elucidating how and when they can be used, and describing how the visual cues are used to build them. Our …

Message-Locked Searchable Encryption: A New Versatile Tool For Secure Cloud Storage, Xueqiao Liu, Guomin Yang, Willy Susilo, Joseph Tonien, Rongmao Chen, Xixiang Lv

Research Collection School Of Computing and Information Systems

Message-Locked Encryption (MLE) is a useful tool to enable deduplication over encrypted data in cloud storage. It can significantly improve the cloud service quality by eliminating redundancy to save storage resources, and hence user cost, and also providing defense against different types of attacks, such as duplicate faking attack and brute-force attack. A typical MLE scheme only focuses on deduplication. On the other hand, supporting search operations on stored content is another essential requirement for cloud storage. In this article, we present a message-locked searchable encryption (MLSE) scheme in a dual-server setting, which achieves simultaneously the desirable features of supporting …

Structure-Aware Visualization Retrieval, Haotian Li, Yong Wang, Aoyu Wu, Huan Wei, Huamin. Qu

Research Collection School Of Computing and Information Systems

With the wide usage of data visualizations, a huge number of Scalable Vector Graphic (SVG)-based visualizations have been created and shared online. Accordingly, there has been an increasing interest in exploring how to retrieve perceptually similar visualizations from a large corpus, since it can benefit various downstream applications such as visualization recommendation. Existing methods mainly focus on the visual appearance of visualizations by regarding them as bitmap images. However, the structural information intrinsically existing in SVG-based visualizations is ignored. Such structural information can delineate the spatial and hierarchical relationship among visual elements, and characterize visualizations thoroughly from a new perspective. …

Active Warden Attack: On The (In)Effectiveness Of Android App Repackage-Proofing, Haoyu Ma, Shijia Li, Debin Gao, Daoyuan Wu, Qiaowen Jia, Chunfu Jia

Research Collection School Of Computing and Information Systems

App repackaging has raised serious concerns to the Android ecosystem with the repackage-proofing technology attracting attention in the Android research community. In this paper, we first show that existing repackage-proofing schemes rely on a flawed security assumption, and then propose a new class of active warden attack that intercepts and falsifies the metrics used by repackage-proofing for detecting the integrity violations during repackaging. We develop a proof-of-concept toolkit to demonstrate that all the existing repackage-proofing schemes can be bypassed by our attack toolkit. On the positive side, our analysis further identifies a new integrity metric in the Android ART runtime …

Cyber Frameworks Small Business Application, Sergio Gonzales

Electronic Theses, Projects, and Dissertations

This project is an analysis of two cyber-attack analysis frameworks and how they may relate to a small business environment. Small businesses suffer significantly from malware attacks like ransomware. This analysis looks at the Cyber Kill Chain framework and the MITRE ATT&CK framework by looking at how each compare when applied to a simple small network and a malware attack. Each framework broke down the cyber-attack differently and by looking at how the frameworks performed within the simplified network provided insights to when small businesses should focus on malware risk reduction. Each framework, despite having different methods of analysis, arrived …

Improving Kernel Artifact Extraction In Linux Memory Samples Using The Slub Allocator, Daniel A. Donze

LSU Master's Theses

Memory forensics allows an investigator to analyze the volatile memory (RAM) of a computer, providing a view into the system state of the machine as it was running. Examples of items found in memory samples that are of interest to investigators are kernel data structures which can represent processes, files, and sockets. The SLUB allocator is the default small-request memory allocator for modern Linux systems. SLUB allocates “slabs”, which are contiguous sections of pre-allocated memory that are used to efficiently service allocation requests. The predecessor to SLUB, the SLAB allocator, tracked every slab it allocated, allowing extraction of allocated slabs …

Malware And Memory Forensics On M1 Macs, Charles E. Glass

LSU Master's Theses

As malware continues to evolve, infection mechanisms that can only be seen in memory are increasingly commonplace. These techniques evade traditional forensic analysis, requiring the use of memory forensics. Memory forensics allows for the recovery of historical data created by running malware, including information that it tries to hide. Memory analysis capabilities have lagged behind on Apple's new M1 architecture while the number of malicious programs only grows. To make matters worse, Apple has developed Rosetta 2, the translation layer for running x86_64 binaries on an M1 Mac. As a result, all malware compiled for Intel Macs is theoretically functional …

Performance Improvements In Inner Product Encryption, Serena Riback

Honors Scholar Theses

Consider a database that contains thousands of entries of the iris biometric. Each entry identifies an individual, so it is especially important that it remains secure. However, searching for entries among an encrypted database proves to be a security problem - how should one search encrypted data without leaking any information to a potential attacker? The proximity searchable encryption scheme, as discussed in the work by Cachet et al., uses the notions of inner product encryption developed by Kim et al.. In this paper, we will focus on the efficiency of these schemes. Specifically, how the symmetry of the bilinear …

Sandworms And Computer Worms: An Assessment Of American Critical Infrastructure Cyber Vulnerabilities And The Russian Federation's Growing Offensive Capabilities, Spencer Johns

Honors Theses

Bottom Line Up Front: It is highly likely that the Russian GRU has the capability, resources, and intent to execute cyberweapon attacks against American critical infrastructure in times of heightened tensions, either as a warning or a first strike. I also assess that much of current American critical infrastructure is not secure enough to withstand a coordinated assault by the GRU, and very likely has numerous severe vulnerabilities known by the GRU.

A Review Of Dark Web: Crawling And Discovery Of Information, Timothy Williams, Edwin Matthew, Juanjose Rodriguez-Cardenas, Jack Wright, Hossain Shahriar

Symposium of Student Scholars

The dark web is often discussed in taboo by many who are unfamiliar with the subject. However, this essay takes a dive into the skeleton of what constructs the dark web by compiling the research of published essays. TOR and other discussed browsers are specialized web browsers that provide anonymity by going through multiple servers and encrypted networks between the host and client, hiding the IP address of both ends. This provides difficulty in terms of controlling or monitoring the dark web, leading to its popularity in criminal underworlds.

In this work, we provide an overview of data mining and …

Deep Learning: The Many Approaches Of Intrusion Detection System Can Be Implemented And Improved Upon, Trinity Taylor

Cybersecurity Undergraduate Research Showcase

For my research topic I decided to look at Deep learning. Deep learning can be used in many ways for example in web searching. Deep learning can also can improve new businesses and products. Deep learning could lead to amazing discoveries. Deep learning is making a neural network learn something. In my research I talk about Intrusion detection system, traditional approach for intrusion detection, existing intrusion detection, machine learning and deep learning based intrusion detection system, and future work.

Improving Memory Forensics Capabilities On Apple M1 Computers, Raphaela Santos Mettig Rocha

LSU Master's Theses

Malware threats are rapidly evolving to use more sophisticated attacks. By abusing rich application APIs such as Objective-C’s, they are able to gather information about user activity, launch background processes without the user’s knowledge as well as perform other malicious activities. In some cases, memory forensics is the only way to recover artifacts related to this malicious activity, as is the case with memory-only execution. The introduction of the Rosetta 2 on the Apple M1 introduces a completely new attack surface by allowing binaries of both Intel x86 64 and ARM64 architecture to run in userland. For this reason it …

Deapsecure Computational Training For Cybersecurity: Third-Year Improvements And Impacts, Bahador Dodge, Jacob Strother, Rosby Asiamah, Karina Arcaute, Wirawan Purwanto, Masha Sosonkina, Hongyi Wu

Modeling, Simulation and Visualization Student Capstone Conference

The Data-Enabled Advanced Training Program for Cybersecurity Research and Education (DeapSECURE) was introduced in 2018 as a non-degree training consisting of six modules covering a broad range of cyberinfrastructure techniques, including high performance computing, big data, machine learning and advanced cryptography, aimed at reducing the gap between current cybersecurity curricula and requirements needed for advanced research and industrial projects. By its third year, DeapSECURE, like many other educational endeavors, experienced abrupt changes brought by the COVID-19 pandemic. The training had to be retooled to adapt to fully online delivery. Hands-on activities were reformatted to accommodate self-paced learning. In this paper, …

Fake Profile Detection On Social Media Using Generative Adversarial Networks (Gans), Edidiong Akpan

ATU Scholars Symposium

Generative Adversarial Networks (GANs) is an artificial intelligence framework used to make computers inventive. This has been applied in several areas of security such as intrusion detection systems. With the wave of globalization and increased social media presence, security has become a thing of concern. For instance, social media security breaches and faking has become one of the many things people are subjected to ranging from impersonation, cyberbullying, stalking, fraud, fleecing of personal assets, and issuing online threats behind fake profiles, these fake profiles are created either by hacking an existing account or by copying the lifestyle and events shared …

Performing Memory Forensics For Object Recovery From Android Application Memory, Sneha Sudhakaran

LSU Doctoral Dissertations

The analysis of application-specific behavior has become an increasingly important technique in cyber forensics and incident response. The ability to determine the precise actions taken by a user can be the difference between a successful analysis and one that fails to meet its goals. The precise actions includes URLs visited, files downloaded, messages sent and received, images viewed, and data accessed. Evidence extraction from application memory at runtime is an effective solution to successfully extract valuable objects allocated by each application, and it is evident that there is a need for more Android forensics analysis tools that support recovering evidence …

Cybersecurity And Threat Modeling, Kumar Setty

Computer Science Research Seminars and Symposia

An introduction to cybersecurity and threat modeling.

Lyapunov-Based Economic Model Predictive Control For Detecting And Handling Actuator And Simultaneous Sensor/Actuator Cyberattacks On Process Control Systems, Henrique Oyama, Dominic Messina, Keshav Kasturi Rangan, Helen Durand

Chemical Engineering and Materials Science Faculty Research Publications

The controllers for a cyber-physical system may be impacted by sensor measurement cyberattacks, actuator signal cyberattacks, or both types of attacks. Prior work in our group has developed a theory for handling cyberattacks on process sensors. However, sensor and actuator cyberattacks have a different character from one another. Specifically, sensor measurement attacks prevent proper inputs from being applied to the process by manipulating the measurements that the controller receives, so that the control law plays a role in the impact of a given sensor measurement cyberattack on a process. In contrast, actuator signal attacks prevent proper inputs from being applied …

Medical Devices And Cybersecurity, Hilary Finch

School of Cybersecurity Posters

I begin by looking at the role of cybersecurity in the medical world. The healthcare industry adopted information technology quite quickly. While the advancement was obviously beneficial and necessary to keep up with an ever-growing demand, the healthcare industry did not place any kind of pointed focus on the security of their IT department, or the sensitive information housed therein.

When rapid advancements of technology outpaced the gradual advancement of hospital cybersecurity, security concerns became a difficult issue to control. There is a serious need for more advancements in hospital security. Each interconnected medical device has its own unique security …

Application Of U.S. Sanction Laws And Ransomware Payments, Trinity Woodbury

Cybersecurity Undergraduate Research Showcase

Ransomware is a major threat that widely affects individuals and organizations, including businesses. Ransomware victims face the situation of potentially paying ransom payments to threat actors, some of whom might be foreign-based criminals. Ransomware affects victims from all sectors and industries.