Information Security Commons^™

A Constructive Direst Security Threat Modeling For Drone As A Service, Fahad E. Salamh, Umit Karabiyik, Marcus Rogers

Journal of Digital Forensics, Security and Law

The technology used in drones is similar or identical across drone types and components, with many common risks and opportunities. The purpose of this study is to enhance the risk assessment procedures for Drone as a Service (DaaS) capabilities. STRIDE is an acronym that includes the following security risks: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privileges. The paper presents a modified STRIDE threat model and prioritize its desired properties (i.e., authenticity, integrity, non-reputability, confidentiality, availability, and authorization) to generate an appropriate DaaS threat model. To this end, the proposed DIREST threat model better meets the …

Efficacy Of Incident Response Certification In The Workforce, Samuel Jarocki

Masters Theses & Doctoral Dissertations

Numerous cybersecurity certifications are available both commercially and via institutes of higher learning. Hiring managers, recruiters, and personnel accountable for new hires need to make informed decisions when selecting personnel to fill positions. An incident responder or security analyst's role requires near real-time decision-making, pervasive knowledge of the environments they are protecting, and functional situational awareness. This concurrent mixed methods paper studies whether current commercial certifications offered in the cybersecurity realm, particularly incident response, provide useful indicators for a viable hiring candidate.

Managers and non-managers alike do prefer hiring candidates with an incident response certification. Both groups affirmatively believe commercial …

Clustering Web Users By Mouse Movement To Detect Bots And Botnet Attacks, Justin L. Morgan

Master's Theses

The need for website administrators to efficiently and accurately detect the presence of web bots has shown to be a challenging problem. As the sophistication of modern web bots increases, specifically their ability to more closely mimic the behavior of humans, web bot detection schemes are more quickly becoming obsolete by failing to maintain effectiveness. Though machine learning-based detection schemes have been a successful approach to recent implementations, web bots are able to apply similar machine learning tactics to mimic human users, thus bypassing such detection schemes. This work seeks to address the issue of machine learning based bots bypassing …

Privacy-Preserving Federated Deep Learning With Irregular Users, Guowen Xu, Hongwei Li, Yun Zhang, Shengmin Xu, Jianting Ning, Robert H. Deng

Research Collection School Of Computing and Information Systems

Federated deep learning has been widely used in various fields. To protect data privacy, many privacy-preserving approaches have also been designed and implemented in various scenarios. However, existing works rarely consider a fundamental issue that the data shared by certain users (called irregular users) may be of low quality. Obviously, in a federated training process, data shared by many irregular users may impair the training accuracy, or worse, lead to the uselessness of the final model. In this paper, we propose PPFDL, a Privacy-Preserving Federated Deep Learning framework with irregular users. In specific, we design a novel solution to reduce …

Investigating The Adoption Of Hybrid Encrypted Cloud Data Deduplication With Game Theory, Xueqin Liang, Zheng Yan, Robert H. Deng, Qinghu Zheng

Research Collection School Of Computing and Information Systems

Encrypted data deduplication, along with different preferences in data access control, brings the birth of hybrid encrypted cloud data deduplication (H-DEDU for short). However, whether H-DEDU can be successfully deployed in practice has not been seriously investigated. Obviously, the adoption of H-DEDU depends on whether it can bring economic benefits to all stakeholders. But existing economic models of cloud storage fail to support H-DEDU due to complicated interactions among stakeholders. In this article, we establish a formal economic model of H-DEDU by formulating the utilities of all involved stakeholders, i.e., data holders, data owners, and Cloud Storage Providers (CSPs). Then, …

Infiniband Network Monitoring: Challenges And Possibilities, Kyle D. Hintze

Theses and Dissertations

Within the realm of High Performance Computing, the InfiniBand Architecture is among the leading interconnects used today. Capable of providing high bandwidth and low latency, InfiniBand is finding applications outside the High Performance Computing domain. One of these is critical infrastructure, encompassing almost all essential sectors as the work force becomes more connected. InfiniBand is not immune to security risks, as prior research has shown that common traffic analyzing tools cannot effectively monitor InfiniBand traffic transmitted between hosts, due to the kernel bypass nature of the IBA in conjunction with Remote Direct Memory Access operations. If Remote Direct Memory Access …

Remote Monitoring Of Memory Data Structures For Malware Detection In A Talos Ii Architecture, Robert A. Willburn

Theses and Dissertations

New forms of malware, namely xC;leless malware and rootkits, pose a threat to traditional anti-malware. In particular, Rootkits have the capacity to obscure the present state of memory from the user space of a target machine. If thishappens, anti-malware running in the user space of an axB;ected machine cannot be trusted to operate properly. To combat this threat, this research proposes the remote monitoring of memory from a second, secure processor runningOpenBMC, serving as a baseboard management controller for a POWER9 processor, which is assumed vulnerable to exploitation. The baseboard management controller includes an application called pdbg, used for debugging …

A Consent Framework For The Internet Of Things In The Gdpr Era, Gerald Chikukwa

Masters Theses & Doctoral Dissertations

The Internet of Things (IoT) is an environment of connected physical devices and objects that communicate amongst themselves over the internet. The IoT is based on the notion of always-connected customers, which allows businesses to collect large volumes of customer data to give them a competitive edge. Most of the data collected by these IoT devices include personal information, preferences, and behaviors. However, constant connectivity and sharing of data create security and privacy concerns. Laws and regulations like the General Data Protection Regulation (GDPR) of 2016 ensure that customers are protected by providing privacy and security guidelines to businesses. Data …

Block The Root Takeover: Validating Devices Using Blockchain Protocol, Sharmila Paul

Masters Theses & Doctoral Dissertations

This study addresses a vulnerability in the trust-based STP protocol that allows malicious users to target an Ethernet LAN with an STP Root-Takeover Attack. This subject is relevant because an STP Root-Takeover attack is a gateway to unauthorized control over the entire network stack of a personal or enterprise network. This study aims to address this problem with a potentially trustless research solution called the STP DApp. The STP DApp is the combination of a kernel /net modification called stpverify and a Hyperledger Fabric blockchain framework in a NodeJS runtime environment in userland. The STP DApp works as an Intrusion …

Traversing Nat: A Problem, Tyler Flaagan

Masters Theses & Doctoral Dissertations

This quasi-experimental before-and-after study measured and analyzed the impacts of adding security to a new bi-directional Network Address Translation (NAT). Literature revolves around various types of NAT, their advantages and disadvantages, their security models, and networking technologies’ adoption. The study of the newly created secure bi-directional model of NAT showed statistically significant changes in the variables than another model using port forwarding. Future research of how data will traverse networks is crucial in an ever-changing world of technology.

Cybersecurity Education For Non-Technical Learners, Matthew Mcnulty

Masters Theses & Doctoral Dissertations

Today’s world is increasingly reliant on technology for school, work, entertainment, and general home use. Many jobs today could not be performed without the use of computer systems or other technology. As lives become intertwined with technology, everyone will inevitably encounter malicious, vulnerable, or privacy-compromising devices or services. Unfortunately, knowledge of how to deal with these cybersecurity and privacy issues is not something that falls within the domain of common knowledge for the everyday person. Additionally, there is a lack of work being done to understand the educational needs of various groups within the general public and educate them. This …

Fast Scene Labeling Via Structural Inference, Huaidong Zhang, Chu Han, Xiaodan Zhang, Yong Du, Xuemiao Xu, Guoqiang Han, Jing Qin, Shengfeng He

Research Collection School Of Computing and Information Systems

Scene labeling or parsing aims to assign pixelwise semantic labels for an input image. Existing CNN-based models cannot leverage the label dependencies, while RNN-based models predict labels within the local context. In this paper, we propose a fast LSTM scene labeling network via structural inference. A minimum spanning tree is used to build the image structure for constructing semantic relationships. This structure allows efficient generation of direct parent-child dependencies for arbitrary levels of superpixels, and thus structural relationships can be learned with LSTM. In particular, we propose a bi-directional recurrent network to model the information flow along the parent-child path. …

Privacy-Preserving Multi-Keyword Searchable Encryption For Distributed Systems, Xueqiao Liu, Guomin Yang, Willy Susilo, Joseph Tonien, Jian Shen

Research Collection School Of Computing and Information Systems

As cloud storage has been widely adopted in various applications, how to protect data privacy while allowing efficient data search and retrieval in a distributed environment remains a challenging research problem. Existing searchable encryption schemes are still inadequate on desired functionality and security/privacy perspectives. Specifically, supporting multi-keyword search under the multi-user setting, hiding search pattern and access pattern, and resisting keyword guessing attacks (KGA) are the most challenging tasks. In this article, we present a new searchable encryption scheme that addresses the above problems simultaneously, which makes it practical to be adopted in distributed systems. It not only enables multi-keyword …

Traceable Monero: Anonymous Cryptocurrency With Enhanced Accountability, Yannan Li, Guomin Yang, Wily Susilo, Yong Yu, Man Ho Au, Dongxi Liu

Research Collection School Of Computing and Information Systems

Monero provides a high level of anonymity for both users and their transactions. However, many criminal activities might be committed with the protection of anonymity in cryptocurrency transactions. Thus, user accountability (or traceability) is also important in Monero transactions, which is unfortunately lacking in the current literature. In this paper, we fill this gap by introducing a new cryptocurrency named Traceable Monero to balance the user anonymity and accountability. Our framework relies on a tracing authority, but is optimistic, in that it is only involved when investigations in certain transactions are required. We formalize the system model and security model …

Web Design Attributes Guideline To Reinforce User Trust, Satisfaction, And Loyalty For Malaysian University Students, Ranjen Naidu Vasudiven

Student Works (2020-2029)

Web site design is the most crucial factor influencing the online e-commerce business. It determines the customer's trust in the products and owners, increasing sales and recognizing its brand. There is currently no reference to understanding Malaysian university students' user preference in web site design. For this study, we evaluated Malaysian university students' user preferences for website design attributes mainly comprised of (interactivity, navigation typography, colour, and content quality). The analysis of the user preferences on the website attributes, the relationship of the attributes with the Malaysian cultures, and the findings based on the three Malaysian mostly visited bookstore websites …

Securing Anonymous Authenticated Announcement Protocol For Group Signature In Internet Of Vehicle, Nur Afiqah Suzelan Amir

Student Works (2020-2029)

The past decade has witnessed a growing interest in vehicular networking and its vast array of potential applications. Improved wireless internet connectivity from vehicles has prompted road safety technologies to emerge. Announcement protocol in Internet of Vehicles (IoV) is an intelligent application to improve road safety, relieve traffic congestion and enhance the comfort of transportation. IoV has drawn extensive attention to provide more enjoyable and safer driving environment. It requires communication between vehicles, roadside units and pedestrian to disseminate safety related messages. Vehicular cloud (VC) computing can guarantee reliable and timely broadcast of safety messages. The integration of IoV and …

Identification Of Lsb Image Steganography Using Cover Image Comparisons, Michael Pelosi, Chuck Easttom

Journal of Digital Forensics, Security and Law

Steganography has long been used to counter forensic investigation. This use of steganography as an anti-forensics technique is becoming more widespread. This requires forensic examiners to have additional tools to more effectively detect steganography. In this paper we introduce a new software concept specifically designed to allow the digital forensics professional to clearly identify and attribute instances of LSB image steganography by using the original cover image in side-by-side comparison with a suspected steganographic payload image. This technique is embodied in a software implementation named CounterSteg. The CounterSteg software allows detailed analysis and comparison of both the original cover …

Backup And Recovery Mechanisms Of Cassandra Database: A Review, Karina Bohora, Amol Bothe, Damini Sheth, Rupali Chopade, V. K. Pachghare

Journal of Digital Forensics, Security and Law

Cassandra is a NoSQL database having a peer-to-peer, ring-type architecture. Cassandra offers fault-tolerance, data replication for higher availability as well as ensures no single point of failure. Given that Cassandra is a NoSQL database, it is evident that it lacks the amount of research that has gone into comparatively older and more widely and broadly used SQL databases. Cassandra’s growing popularity in recent times gives rise to the need of addressing any security-related or recovery-related concerns associated with its usage. This review paper discusses the existing deletion mechanism in Cassandra and presents some identified issues related to backup and recovery …

Social Media User Relationship Framework (Smurf), Anne David, Sarah Morris, Gareth Appleby-Thomas

Journal of Digital Forensics, Security and Law

The use of social media has spread through many aspects of society, allowing millions of individuals, corporate as well as government entities to leverage the opportunities it affords. These opportunities often end up being exploited by a small percentage of the user community who use it for objectionable or unlawful activities; for example, trolling, cyber bullying, grooming, luring. In some cases, these unlawful activities result in investigations where swift retrieval of critical evidence required in order to save a life.

This paper presents a proof of concept (PoC) framework for social media user attribution. The framework aims to provide digital …

A Microservice-Based Architecture For An Online Product Review Analysis System, Mehdi Mohammadi

Student Works (2020-2029)

Since the emergence of Web 2.0 in late 1999, online product reviews have played a significant role in the e-commerce channels, social media, online forums, and online communities. The majority of studies in the area of product review analysis (PRA) systems have focused on evaluating and improving the techniques for review analysis to increase efficiency, accuracy, effectiveness, usefulness, ranking, spam detection, and feature extraction. The architecture of PRA systems is not the primary concern of research in this field. In this study, some of the implicit and explicit architectures of scientifically reported PRA systems were extracted to examine how the …