Information Security Commons^™

Authenticated Data Redaction With Accountability And Transparency, Jinhua Ma, Xinyi Huang, Yi Mu, Robert H. Deng

Research Collection School Of Computing and Information Systems

A common practice in data redaction is removing sensitive information prior to data publication or release. In data-driven applications, one must be convinced that the redacted data is still trustworthy. Meanwhile, the data redactor must be held accountable for (malicious) redaction, which could change/hide the meaning of the original data. Motivated by these concerns, we present a novel solution for authenticated data redaction based on a new Redactable Signature Scheme with Implicit Accountability (RSS - IA). In the event of a dispute, not only the original data signer but also the redactor can generate an evidence tag to unequivocally identify …

Novel Secure Outsourcing Of Modular Inversion For Arbitrary And Variable Modulus, Chengliang Tian, Jia Yu, Hanlin Zhang, Haiyang Xue, Cong Wang, Kui Ren

Research Collection School Of Computing and Information Systems

In cryptography and algorithmic number theory, modular inversion is viewed as one of the most common and time-consuming operations. It is hard to be directly accomplished on resource-constrained clients (e.g., mobile devices and IC cards) since modular inversion involves a great amount of operations on large numbers in practice. To address the above problem, this paper proposes a novel unimodular matrix transformation technique to realize secure outsourcing of modular inversion. This technique makes our algorithm achieve several amazing properties. First, to the best of our knowledge, it is the first secure outsourcing computation algorithm that supports arbitrary and variable modulus, …

Edge-Iiotset: A New Comprehensive Realistic Cyber Security Dataset Of Iot And Iiot Applications For Centralized And Federated Learning, Mohamed A. Ferrag, Othmane Friha, Djallel Hamouda, Leandros Maglaras, Helge Janicke

Research outputs 2022 to 2026

In this paper, we propose a new comprehensive realistic cyber security dataset of IoT and IIoT applications, called Edge-IIoTset, which can be used by machine learning-based intrusion detection systems in two different modes, namely, centralized and federated learning. Specifically, the dataset has been generated using a purpose-built IoT/IIoT testbed with a large representative set of devices, sensors, protocols and cloud/edge configurations. The IoT data are generated from various IoT devices (more than 10 types) such as Low-cost digital sensors for sensing temperature and humidity, Ultrasonic sensor, Water level detection sensor, pH Sensor Meter, Soil Moisture sensor, Heart Rate Sensor, Flame …

A Review On Security Issues And Solutions Of The Internet Of Drones, Wencheng Yang, Song Wang, Xuefei Yin, Xu Wang, Jiankun Hu

Research outputs 2022 to 2026

The Internet of Drones (IoD) has attracted increasing attention in recent years because of its portability and automation, and is being deployed in a wide range of fields (e.g., military, rescue and entertainment). Nevertheless, as a result of the inherently open nature of radio transmission paths in the IoD, data collected, generated or handled by drones is plagued by many security concerns. Since security and privacy are among the foremost challenges for the IoD, in this paper we conduct a comprehensive review on security issues and solutions for IoD security, discussing IoD-related security requirements and identifying the latest advancement in …

A Low-Cost Machine Learning Based Network Intrusion Detection System With Data Privacy Preservation, Jyoti Fakirah, Lauhim Mahfuz Zishan, Roshni Mooruth, Michael L. Johnstone, Wencheng Yang

Research outputs 2022 to 2026

Network intrusion is a well-studied area of cyber security. Current machine learning-based network intrusion detection systems (NIDSs) monitor network data and the patterns within those data but at the cost of presenting significant issues in terms of privacy violations which may threaten end-user privacy. Therefore, to mitigate risk and preserve a balance between security and privacy, it is imperative to protect user privacy with respect to intrusion data. Moreover, cost is a driver of a machine learning-based NIDS because such systems are increasingly being deployed on resource-limited edge devices. To solve these issues, in this paper we propose a NIDS …

Asymmetrical Trusted Technology Networks In Developing Economies: A Case Study On Critical Infrastructure In Bhutan, Pratima Pradhan, Bal Subba, Thinley Jamtsho, Ganga Ram Ghimiray, David M. Cook

Research outputs 2022 to 2026

Developing Nations are subject to amplified challenges in terms of the integration of technology, and the exposure to non-domestic opportunism from larger neighboring economies. These challenges are recognizable as asymmetrical differences between what is seen as the normative list of critical infrastructures, and the specialisms that can dominate an emerging economy with early maturity technology networks. This paper discusses the case of Bhutan and demonstrates the need for strengthened approaches to trusted networks to ensure the reliability and continuity of the Nation's critical infrastructures. The paper also links the importance of trusted information sharing networks as part of an overarching …

Privacy Preserving For Multiple Computer Vision Tasks, Amala Varghese Wilson

Master's Projects

Privacy-preserving visual recognition is an important area of research that is gaining momentum in the field of computer vision. In a production environment, it is critical to have neural network models learn continually from user data. However, sharing raw user data with a server is less desirable from a regulatory, security and privacy perspective. Federated learning addresses the problem of privacy- preserving visual recognition. More specifically, we closely examine and dissect a framework known as Dual User Adaptation (DUA) presented by Lange et al. at CVPR 2020, due to its novel idea of bringing about user-adaptation on both the server-side …

Identifying Bots On Twitter With Benford’S Law, Sanmesh Bhosale

Master's Projects

Over time Online Social Networks (OSNs) have grown exponentially in terms of active users and have now become an influential factor in the formation of public opinions. Due to this, the use of bots and botnets for spreading misinformation on OSNs has become a widespread concern. The biggest example of this was during the 2016 American Presidential Elections, where Russian bots on Twitter pumped out fake news to influence the election results.

Identifying bots and botnets on Twitter is not just based on visual analysis and can require complex statistical methods to score a profile based on multiple features and …

Extending The Quality Of Secure Service Model To Multi-Hop Networks, Paul M. Simon, Scott R. Graham

Faculty Publications

Rarely are communications networks point-to-point. In most cases, transceiver relay stations exist between transmitter and receiver end-points. These relay stations, while essential for controlling cost and adding flexibility to network architectures, reduce the overall security of the respective network. In an effort to quantify that reduction, we extend the Quality of Secure Service (QoSS) model to these complex networks, specifically multi-hop networks. In this approach, the quantification of security is based upon probabilities that adversarial listeners and disruptors gain access to or manipulate transmitted data on one or more of these multi-hop channels. Message fragmentation and duplication across available channels …

Analyzing And Detecting Android Malware And Deepfake, Md Shohel Rana

Dissertations

Rapid advances in artificial intelligence (AI), machine learning (ML), and deep learning (DL) over the past several decades have produced a variety of technologies and tools that, among numerous cybersecurity issues, have enticed cybercriminals and hackers to design malware for the Android operating systems and/or manipulate multimedia. For example, high-quality and realistic fake videos, images, or audios have been created to spread misinformation and propaganda, foment political discord and hate, or even harass and blackmail people; these manipulated, high-quality and realistic videos became known recently as Deepfake. There has been much work done in recent years on malware analysis and …

Performance Assessment Of Some Phishing Predictive Models Based On Minimal Feature Corpus, Orunsolu Abdul Abiodun, Sodiya A.S, Kareem S.O, Oladimeji G. B Mr.

Journal of Digital Forensics, Security and Law

Phishing is currently one of the severest cybersecurity challenges facing the emerging online community. With damages running into millions of dollars in financial and brand losses, the sad tale of phishing activities continues unabated. This led to an arms race between the con artists and online security community which demand a constant investigation to win the cyberwar. In this paper, a new approach to phishing is investigated based on the concept of minimal feature set on some selected remarkable machine learning algorithms. The goal of this is to select and determine the most efficient machine learning methodology without undue high …

An Analysis Of Significant Cyber Incidents And The Impact On The Past, Present, And Future, Seth E. Smith

Cybersecurity Undergraduate Research Showcase

This report discusses data collected on significant cybersecurity incidents from the early 2000s to present. The first part of the report addresses previously discussed information, data, and literature (e.g. case studies), pertinent to cybersecurity incidents. The findings from this study are framed by scholarly sources and information from the Federal Bureau of Investigation, a number of notable universities, and literature online, of which all support information discussed within this report. The second part of the report discusses data compiled upon analyzing significant cyber incidents and events from the Center for Strategic and International Affairs (CSIS). Finally, the last portion of …

Analytical Approach To Biometric Security And How It Affects Privacy, Torré A. Williams

Cybersecurity Undergraduate Research Showcase

In this time where the world is using technology every day, there is going to be a need for some type of security to take place to protect its citizens from unwanted harm or danger. The use of any authentication methods is becoming very essential for a lot of companies and even for your own personal belongings. The use of biometric technology has offered companies the chance to upgrade their security system. This has also provided easier ways that people authenticate themselves as who they say they are. Due to their growth of usage, there is a privacy and security …

A Fine-Grained Attribute Based Data Retrieval With Proxy Re-Encryption Scheme For Data Outsourcing Systems, Hanshu Hong, Ximeng Liu, Zhixin Sun

Research Collection School Of Computing and Information Systems

Attribute based encryption is suitable for data protection in data outsourcing systems such as cloud computing. However, the leveraging of encryption technique may retrain some routine operations over the encrypted data, particularly in the field of data retrieval. This paper presents an attribute based date retrieval with proxy re-encryption (ABDR-PRE) to provide both fine-grained access control and retrieval over the ciphertexts. The proposed scheme achieves fine-grained data access management by adopting KP-ABE mechanism, a delegator can generate the re-encryption key and search indexes for the ciphertexts to be shared over the target delegatee’s attributes. Throughout the process of data sharing, …

Analysis Of Deep Learning Methods For Wired Ethernet Physical Layer Security Of Operational Technology, Lucas Torlay

All Theses

The cybersecurity of power systems is jeopardized by the threat of spoofing and man-in-the-middle style attacks due to a lack of physical layer device authentication techniques for operational technology (OT) communication networks. OT networks cannot support the active probing cybersecurity methods that are popular in information technology (IT) networks. Furthermore, both active and passive scanning techniques are susceptible to medium access control (MAC) address spoofing when operating at Layer 2 of the Open Systems Interconnection (OSI) model. This thesis aims to analyze the role of deep learning in passively authenticating Ethernet devices by their communication signals. This method operates at …

Collaborcrack: A Collaborative Password Cracking Solution For Windows Penetration Testing, Andrew Griess

Theses/Capstones/Creative Projects

Cybersecurity professionals attempt to crack password hashes during penetration tests to determine if they are strong enough. A password hash is a way to encode a password securely. This paper describes a proof-of-concept program called CollaborCrack, a team-based password cracking solution. CollaborCrack addresses the issues of computational complexity, remote cracking security, duplication of work, and the cost associated with password cracking. To address computational complexity, CollaborCrack enables remote password cracking. Remote cracking requires additional safeguards, which CollaborCrack mitigates by storing sensitive information locally. To reduce the duplication of work, CollaborCrack provides a shared interface designed around collaboration and teamwork. CollaborCrack …

Concise Mercurial Subvector Commitments: Definitions And Constructions, Yannan Li, Willy Susilo, Guomin Yang, Tran Viet Xuan Phuong, Yong Yu, Dongxi Liu

Research Collection School Of Computing and Information Systems

Vector commitment and its variants have attracted a lot of attention recently as they have been exposed to a wide range of applications in blockchain. Two special extensions of vector commitments, namely subvector commitments and mercurial commitments, have been proposed with attractive features that are desirable in many applications. Nevertheless, to the best of our knowledge, a single construction satisfying all those attractive features is still missing. In this work, we analyze those important properties and propose a new primitive called mercurial subvector commitments, which are efficiently updatable, mercurial hiding, position binding, and aggregatable. We formalize the system model and …

Broadcast Authenticated Encryption With Keyword Search, Xueqiao Liu, Kai He, Guomin Yang, Willy Susilo, Joseph Tonien, Qiong Huang

Research Collection School Of Computing and Information Systems

The emergence of public-key encryption with keyword search (PEKS) has provided an elegant approach to enable keyword search over encrypted content. Due to its high computational complexity proportional to the number of intended receivers, the trivial way of deploying PEKS for data sharing with multiple receivers is impractical, which motivates the development of a new PEKS framework for broadcast mode. However, existing works suffer from either the vulnerability to keyword guessing attacks (KGA) or high computation and communication complexity. In this work, a new primitive for keyword search in broadcast mode, named broadcast authenticated encryption with keyword search (BAEKS), is …

Hrpdf: A Software-Based Heterogeneous Redundant Proactive Defense Framework For Programmable Logic Controller, Ke Liu, Jing-Yi Wang, Qiang Wei, Zhen-Yong Zhang, Jun Sun, Rong-Kuan Ma, Rui-Long Deng

Research Collection School Of Computing and Information Systems

Programmable logic controllers (PLCs) play a critical role in many industrial control systems, yet face increasingly serious cyber threats. In this paper, we propose a novel PLC-compatible software-based defense mechanism, called Heterogeneous Redundant Proactive Defense Framework (HRPDF). We propose a heterogeneous PLC architecture in HRPDF, including multiple heterogeneous, equivalent, and synchronous runtimes, which can thwart multiple types of attacks against PLC without the need of external devices. To ensure the availability of PLC, we also design an inter-process communication algorithm that minimizes the overhead of HRPDF. We implement a prototype system of HRPDF and test it in a real-world PLC …

Beginning The Information Security Journey For Small And Medium Enterprises Through Business Continuity Planning And Infrastructure Automation, Aaron Chamberlain

Electronic Theses, Projects, and Dissertations

Technology has become an essential component of enterprises, driving productivity, innovation, and defining entire processes and product categories. However, these advances come with additional risk; the devices that drive an enterprise can fail at any time or be attacked by malicious actors. Larger enterprises have learned to deal with these risks, but small and medium-sized enterprises (SMEs) have been largely left behind. This project sought to investigate the cybersecurity-related problems SMEs experience and what SMEs can do to solve them. In addition, the project examines the types of information security incidents that occur within SMEs and their financial preparedness for …