Information Security Commons^™

An Exploratory Study Of Mode Efficacy In Cybersecurity Training, Michael D. Workman

Journal of Cybersecurity Education, Research and Practice

Cybersecurity capabilities in organizations and governmental agencies continue to lag behind the threats. Given the current environment, these entities have placed renewed emphasis on cybersecurity education. However, education appears to lack its full potential in most settings. Few empirical studies have systematically tested the efficacy of various training methods and modes, and those that have been conducted have yielded inconsistent findings. Recent literature on the use of gamified simulations have suggested that they may improve cybersecurity behaviors. Similarly, live activities such as hackathons and capture the flag events have been surmised to augment learning and capabilities. We conducted an exploratory …

An Economical Method For Securely Disintegrating Solid-State Drives Using Blenders, Brandon J. Hopkins Phd, Kevin A. Riggle

Journal of Digital Forensics, Security and Law

Pulverizing solid-state drives (SSDs) down to particles no larger than 2 mm is required by the United States National Security Agency (NSA) to ensure the highest level of data security, but commercial disintegrators that achieve this standard are large, heavy, costly, and often difficult to access globally. Here, we present a portable, inexpensive, and accessible method of pulverizing SSDs using a household blender and other readily available materials. We verify this approach by pulverizing SSDs with a variety of household blenders for fixed periods of time and sieve the resulting powder to ensure appropriate particle size. Among the 6 household …

Certis: Digital Transformation Of A Physical Security Company, Singapore Management University

Perspectives@SMU

How a company synonymous with auxiliary police injected sensors and artificial intelligence into its 21st century operations

A Look Into Increasing The Number Of Veterans And Former Government Employees Converting To Career And Technical Cybersecurity Teachers, Vukica M. Jovanovic, Michael Anthony Crespo, Drew E. Brown, Deborah Marshall, Otilia Popescu, Murat Kuzlu, Petros J. Katsioloudis, Linda Vahala

Engineering Technology Faculty Publications

The current state of technology with recent explosions in the digital processing of paperwork, computer networking use, and online and virtual approaches to areas, which until very recently had traditional and non-computerized ways of operating, led to a steady increase in the demand for jobs in the area of computer science and cybersecurity. The education system, the pipeline for the incoming workforce, needs to keep up with this tremendous pace in technology and the job market. The current K-12 school system has been extensively challenged to fill out necessary positions in order to address the increasing need for programs that …

Privacy-Preserving Proof Of Storage For The Pay-As-You-Go Business Model, Tong Wu, Guomin Yang, Yi Mu, Fuchun Guo, Robert H. Deng

Research Collection School Of Computing and Information Systems

Proof of Storage (PoS) enables a cloud storage provider to prove that a client's data is intact. However, existing PoS protocols are not designed for the pay-as-you-go business model in which payment is made based on both storage volume and duration. In this paper, we propose two PoS protocols suitable for the pay-as-you-go storage business model. The first is a time encapsulated Proof of Retrievability (PoR) protocol that ensures retrievability of the original file upon successful auditing by a client. Considering the large size of outsourced data, we then extend the protocol to a privacy-preserving public auditing protocol which allows …

A Mean-Field Markov Decision Process Model For Spatial-Temporal Subsidies In Ride-Sourcing Markets, Zheng Zhu, Jintao Ke, Hai Wang

Research Collection School Of Computing and Information Systems

Ride-sourcing services are increasingly popular because of their ability to accommodate on-demand travel needs. A critical issue faced by ride-sourcing platforms is the supply-demand imbalance, as a result of which drivers may spend substantial time on idle cruising and picking up remote passengers. Some platforms attempt to mitigate the imbalance by providing relocation guidance for idle drivers who may have their own self-relocation strategies and decline to follow the suggestions. Platforms then seek to induce drivers to system-desirable locations by offering them subsidies. This paper proposes a mean-field Markov decision process (MF-MDP) model to depict the dynamics in ride-sourcing markets …

Rnnrepair: Automatic Rnn Repair Via Model-Based Analysis, Xiaofei Xie, Wenbo Guo, Lei Ma, Wei Le, Jian Wang, Lingjun Zhou, Yang Liu, Xinyu Xing

Research Collection School Of Computing and Information Systems

Deep neural networks are vulnerable to adversarial attacks. Due to their black-box nature, it is rather challenging to interpret and properly repair these incorrect behaviors. This paper focuses on interpreting and repairing the incorrect behaviors of Recurrent Neural Networks (RNNs). We propose a lightweight model-based approach (RNNRepair) to help understand and repair incorrect behaviors of an RNN. Specifically, we build an influence model to characterize the stateful and statistical behaviors of an RNN over all the training data and to perform the influence analysis for the errors. Compared with the existing techniques on influence function, our method can efficiently estimate …

Effect Of Team Cohesion Nn Flow: An Empirical Study Of Team-Based Gamification For Enterprise Resource Planning Systems In Online Classes, Yu Zhao, Mark Srite, Sumin Kim, Jinwoong Lee

Business and Information Technology Faculty Research & Creative Works

Pedagogy using gamification has recently received much attention as a way of enhancing student learning and retention. Additionally, academic institutions are making extensive use of online resources to expand teaching beyond the traditional classroom setting. Both academic institutions and companies utilize virtual teams to accomplish remote teamwork, particularly in a post-COVID environment. Despite the growing interest in incorporating gamification into teaching for business school courses, prior researchers have paid little attention to team-based gamification in the online learning environment. The purpose of this study is to examine if team members' perceived team cohesion influences their perceptions of flow. Also, we …

A Coprocessor-Based Introspection Framework Via Intel Management Engine, Lei Zhou, Fengwei Zhang, Jidong Xiao, Kevin Leach, Westley Weimer, Xuhua Ding, Guojun Wang

Research Collection School Of Computing and Information Systems

During the past decade, virtualization-based (e.g., virtual machine introspection) and hardware-assisted approaches (e.g., x86 SMM and ARM TrustZone) have been used to defend against low-level malware such as rootkits. However, these approaches either require a large Trusted Computing Base (TCB) or they must share CPU time with the operating system, disrupting normal execution. In this article, we propose an introspection framework called NIGHTHAWK that transparently checks system integrity and monitor the runtime state of target system. NIGHTHAWK leverages the Intel Management Engine (IME), a co-processor that runs in isolation from the main CPU. By using the IME, our approach has …

Measuring The Relationship Of Gender Misclassification And Automated Face Recognition Match Accuracy Relative To Skin Tone, Afi Edem-Edi Gbekevi

Theses and Dissertations

The gap of accuracy observed in some commercial face analytic systems based on race and gender raised questions about the equity and fairness of those systems. Since these systems are part of several applications today, some more critical than others, it urges designers to detect and mitigate any sources of bias. In this thesis, we begin by clarifying the confusion between face analytic, face recognition, and face processing systems. Then, we analyze gender classification accuracy using two datasets and three classifiers. The Pilot Parliaments Benchmark dataset is examined with an open-source algorithm to corroborate the gender shade. Secondly, the Morph …

Privacy-Preserving Cloud-Assisted Data Analytics, Wei Bao

Graduate Theses and Dissertations

Nowadays industries are collecting a massive and exponentially growing amount of data that can be utilized to extract useful insights for improving various aspects of our life. Data analytics (e.g., via the use of machine learning) has been extensively applied to make important decisions in various real world applications. However, it is challenging for resource-limited clients to analyze their data in an efficient way when its scale is large. Additionally, the data resources are increasingly distributed among different owners. Nonetheless, users' data may contain private information that needs to be protected.

Cloud computing has become more and more popular in …

Automated Privacy Protection For Mobile Device Users And Bystanders In Public Spaces, David Darling

Graduate Theses and Dissertations

As smartphones have gained popularity over recent years, they have provided usersconvenient access to services and integrated sensors that were previously only available through larger, stationary computing devices. This trend of ubiquitous, mobile devices provides unparalleled convenience and productivity for users who wish to perform everyday actions such as taking photos, participating in social media, reading emails, or checking online banking transactions. However, the increasing use of mobile devices in public spaces by users has negative implications for their own privacy and, in some cases, that of bystanders around them.

Specifically, digital photography trends in public have negative implications for …

Development Of A Reference Design For Intrusion Detection Using Neural Networks For A Smart Inverter, Ammar Mohammad Khan

Graduate Theses and Dissertations

The purpose of this thesis is to develop a reference design for a base level implementation of an intrusion detection module using artificial neural networks that is deployed onto an inverter and runs on live data for cybersecurity purposes, leveraging the latest deep learning algorithms and tools. Cybersecurity in the smart grid industry focuses on maintaining optimal standards of security in the system and a key component of this is being able to detect cyberattacks. Although researchers and engineers aim to design such devices with embedded security, attacks can and do still occur. The foundation for eventually mitigating these attacks …

Design And Development Of Techniques To Ensure Integrity In Fog Computing Based Databases, Abdulwahab Fahad S. Alazeb

Graduate Theses and Dissertations

The advancement of information technology in coming years will bring significant changes to the way sensitive data is processed. But the volume of generated data is rapidly growing worldwide. Technologies such as cloud computing, fog computing, and the Internet of things (IoT) will offer business service providers and consumers opportunities to obtain effective and efficient services as well as enhance their experiences and services; increased availability and higher-quality services via real-time data processing augment the potential for technology to add value to everyday experiences. This improves human life quality and easiness. As promising as these technological innovations, they are prone …

Quantifying Cyber Risk By Integrating Attack Graph And Impact Graph, Omer F. Keskin

Engineering Management & Systems Engineering Theses & Dissertations

Being a relatively new risk source, models to quantify cyber risks are not well developed; therefore, cyber risk management in most businesses depends on qualitative assessments. With the increase in the economic consequences of cyber incidents, the importance of quantifying cyber risks has increased. Cyber risk quantification is also needed to establish communication among decision-makers of different levels of an enterprise, from technical personnel to top management.

The goal of this research is to build a probabilistic cybersecurity risk analysis model that relates attack propagation with impact propagation through internal dependencies and allows temporal analysis.

The contributions of the developed …

Strengthening Criteria Independence Through Optimization Of Alternative Value Ratio Comparisons, Joseph P. Kristbaum, Frank W. Ciarallo

Faculty Publications

Every decision maker’s internal scale is different based on a myriad of possible factors unique to that decision maker. Conflicting criteria within and between alternatives in multicriteria decision making can create negative effects within the weighting schemes and amplify preference biases and scale disparities between decision makers in a group decision context. Additionally, the weighting of group decision-making frameworks can intensify the already skewed criteria values. When making judgments against requirements, it may be preferable to reduce scale trend distortions between decision makers as much as possible. Previous research supports that certain information presentation modes can significantly reduce preference bias …

Understanding Ransomware Trajectory To Create An Informed Prediction, J. D. Klusnick

University Honors Theses

Ransomware is a form of extortion in which digital files are rendered inaccessible until a ransom payment is made. Modern ransomware emerged in 2006 and its destructive influence has been expanding ever since. In recent years cybercriminals have evolved who they target, what computer systems they target, and how they infect those systems. Meanwhile, cybersecurity experts have modelled ransomware methods allowing them to innovate their defense techniques across three paradigms: recovery, detection, and prevention. Ultimately either ransomware attackers or ransomware defenders will dominate this ongoing conflict. A review of the literature indicates that the ransomware crime wave will likely be …

Windows Kernel Hijacking Is Not An Option: Memoryranger Comes To The Rescue Again, Igor Korkin

Journal of Digital Forensics, Security and Law

The security of a computer system depends on OS kernel protection. It is crucial to reveal and inspect new attacks on kernel data, as these are used by hackers. The purpose of this paper is to continue research into attacks on dynamically allocated data in the Windows OS kernel and demonstrate the capacity of MemoryRanger to prevent these attacks. This paper discusses three new hijacking attacks on kernel data, which are based on bypassing OS security mechanisms. The first two hijacking attacks result in illegal access to files open in exclusive access. The third attack escalates process privileges, without applying …

A Method For Comparative Analysis Of Trusted Execution Environments, Stephano Cetola

Dissertations and Theses

The problem of secure remote computation has become a serious concern of hardware manufacturers and software developers alike. Trusted Execution Environments (TEEs) are a solution to the problem of secure remote computation in applications ranging from "chip and pin" financial transactions to intellectual property protection in modern gaming systems. While extensive literature has been published about many of these technologies, there exists no current model for comparing TEEs. This thesis provides hardware architects and designers with a set of tools for comparing TEEs. I do so by examining several properties of a TEE and comparing their implementations in several technologies. …

Deterring Intellectual Property Thieves: Algorithmic Generation Of Adversary-Aware Fake Knowledge Graphs, Snow Kang

Dartmouth College Undergraduate Theses

Publicly available estimates suggest that in the U.S. alone, IP theft costs our economy between $225 billion and $600 billion each year. In our paper, we propose combating IP theft by generating fake versions of technical documents. If an enterprise system has n fake documents for each real document, any IP thief must sift through an array of documents in an attempt to separate the original from a sea of fakes. This costs the attacker time and money - and inflicts pain and frustration on the part of its technical staff.

Leveraging a graph-theoretic approach, we created the Clique-FakeKG algorithm …