Information Security Commons^™

Csci 380 - Digital Operations And Cybersecurity Management (Syllabus), Eric Spector, Nyc Tech-In-Residence Corps

Open Educational Resources

Syllabus for the course "CSCI 380 - Digital Operations and Cybersecurity Management" delivered at the John Jay COllege in Spring 2020 by Eric Spector as part of the Tech-in-Residence Corps program.

Applications Of Machine Learning To Threat Intelligence, Intrusion Detection And Malware, Charity Barker

Senior Honors Theses

Artificial Intelligence (AI) and Machine Learning (ML) are emerging technologies with applications to many fields. This paper is a survey of use cases of ML for threat intelligence, intrusion detection, and malware analysis and detection. Threat intelligence, especially attack attribution, can benefit from the use of ML classification. False positives from rule-based intrusion detection systems can be reduced with the use of ML models. Malware analysis and classification can be made easier by developing ML frameworks to distill similarities between the malicious programs. Adversarial machine learning will also be discussed, because while ML can be used to solve problems or …

Sdhcare: Secured Distributed Healthcare System, Mohammed R. S. Al Baqari

Information Security Theses

In the healthcare sector, the move towards Electronic Health Records (EHR) systems has been accelerating in parallel with the increased adoption of IoT and smart devices. This is driven by the anticipated advantages for patients and healthcare providers. The integration of EHR and IoT makes it highly heterogeneous in terms of devices, network standards, platforms, types of data, connectivity, etc. Additionally, it introduces security, patient and data privacy, and trust challenges. To address such challenges, this thesis proposes an architecture that combines biometric-based blockchain technology with the EHR system. More specifically, this thesis describes a mechanism that uses a patient’s …

Attribute-Based Cloud Data Integrity Auditing For Secure Outsourced Storage, Yong Yu, Yannan Li, Bo Yang, Willy Susilo, Guomin Yang, Jian Bai

Research Collection School Of Computing and Information Systems

Outsourced storage such as cloud storage can significantly reduce the burden of data management of data owners. Despite of a long list of merits of cloud storage, it triggers many security risks at the same time. Data integrity, one of the most burning challenges in secure cloud storage, is a fundamental and pivotal element in outsourcing services. Outsourced data auditing protocols enable a verifier to efficiently check the integrity of the outsourced files without downloading the entire file from the cloud, which can dramatically reduce the communication overhead between the cloud server and the verifier. Existing protocols are mostly based …

On The Security Of Lwe Cryptosystem Against Subversion Attacks, Zhichao Yang, Rongmao Chen, Chao Li, Longjiang Qu, Guomin Yang

Research Collection School Of Computing and Information Systems

Subversion of cryptography has received wide attentions especially after the Snowden Revelations in 2013. Most of the currently proposed subversion attacks essentially rely on the freedom of randomness choosing in the cryptographic protocol to hide backdoors embedded in the cryptosystems. Despite the fact that significant progresses in this line of research have been made, most of them mainly considered the classical setting, while the research gap regarding subversion attacks against post-quantum cryptography remains tremendous. Inspired by this observation, we investigate a subversion attack against existing protocol that is proved post-quantum secure. Particularly, we show an efficient way to undetectably subvert …

Identity-Based Encryption Transformation For Flexible Sharing Of Encrypted Data In Public Cloud, Robert H. Deng, Zheng Qin, Qianhong Wu, Zhenyu Guan, Robert H. Deng, Yujue Wang, Yunya Zhou

Research Collection School Of Computing and Information Systems

With the rapid development of cloud computing, an increasing number of individuals and organizations are sharing data in the public cloud. To protect the privacy of data stored in the cloud, a data owner usually encrypts his data in such a way that certain designated data users can decrypt the data. This raises a serious problem when the encrypted data needs to be shared to more people beyond those initially designated by the data owner. To address this problem, we introduce and formalize an identity-based encryption transformation (IBET) model by seamlessly integrating two well-established encryption mechanisms, namely identity-basedencryption (IBE) and …

Leakage-Resilient Biometric-Based Remote User Authentication With Fuzzy Extractors, Yangguang Tian, Yingjiu Li, Binanda Sengupta, Nan Li, Chunhua Su

Research Collection School Of Computing and Information Systems

Fuzzy extractors convert biometrics and other noisy data into a cryptographic key for security applications such as remote user authentication. Leakage attacks, such as side channel attacks, have been extensively modelled and studied in the literature. However, to the best of our knowledge, leakage attacks to biometric-based remote user authentication with fuzzy extractors have never been studied rigorously. In this paper, we propose a generic framework of leakage-resilient and privacy-preserving biometric-based remote user authentication that allows an authorized user to securely authenticate herself to a remote authentication server using her biometrics. In particular, the authorized user relies only on her …

Geopolitics And The Digital Domain: How Cyberspace Is Impacting International Security, Georgia Wood

Independent Study Project (ISP) Collection

The digital domain is the emerging environment for which the internet and data connectivity exists. This new domain is challenging the traditional place for geopolitics to exist, and creating new challenges to international relations. The use of cyberweapons through direct cyberattacks, such as the possibility of an attack on the U.S. power grid, or misinformation campaigns, such as the one launched by Russia against the 2016 U.S. Presidential election, can expand the international threat landscape. While these new threats increase, states are widely not prepared to address the new challenges in the digital domain. This paper will use three primary …

Cis 356: Fundamentals Of Cybersecurity And Intelligence Gathering - Hackers, Fahad Chowdhury, Nyc Tech-In-Residence Corps

Open Educational Resources

Lecture for the course: CIS 356: Fundamentals of Cybersecurity and Intelligence Gathering - "Hackers" (Week Three) delivered at Lehman College in Spring 2020 by Fahad Chowdhury as part of the NYC Tech-in-Residence Corps program.

A New Construction For Linkable Secret Handshake, Yangguang Tian, Yingjiu Li, Robert H. Deng, Nan Li, Guomin Yang, Zheng Yang

Research Collection School Of Computing and Information Systems

In this paper, we introduce a new construction for linkable secret handshake that allows authenticated users to perform handshake anonymously within allowable times. We define formal security models for the new construction, and prove that it can achieve session key security, anonymity, untraceability and linkable affiliation-hiding. In particular, the proposed construction ensures that (i) anyone can trace the real identities of dishonest users who perform handshakes for more than k times; and (ii) an optimal communication cost between authorized users is achieved by exploiting the proof of knowledges.

Privacy-Preserving Outsourced Support Vector Machine Design For Secure Drug Discovery, Ximeng Liu, Robert H. Deng, Kim-Kwang Raymond Choo, Yang Yang

Research Collection School Of Computing and Information Systems

In this paper, we propose a framework for privacy-preserving outsourced drug discovery in the cloud, which we refer to as POD. Specifically, POD is designed to allow the cloud to securely use multiple drug formula providers' drug formulas to train Support Vector Machine (SVM) provided by the analytical model provider. In our approach, we design secure computation protocols to allow the cloud server to perform commonly used integer and fraction computations. To securely train the SVM, we design a secure SVM parameter selection protocol to select two SVM parameters and construct a secure sequential minimal optimization protocol to privately refresh …

Energy-Efficient Distance-Bounding With Residual Charge Computation, Yunhui Zhuang, Anjia Yang, Gerhard Hancke, Duncan S. Wong, Guomin Yang

Research Collection School Of Computing and Information Systems

Real-time location systems are often required in industrial applications. In addition to securely determining an item's location, these systems also need to accommodate energy-limited tracking tokens. Distance-bounding protocols enable a Verifier to cryptographically determine an upper-bound on the physical distance to a Prover by measuring the round-trip time of specially designed challenge-response messages. This type of protocols serve as countermeasure to three common attacks on location-based systems and have been extensively studied with the goal of achieving optimal security bounds for the respective attacks. In this paper, we propose a new energy-efficient distance-bounding protocol that protects against all three common …

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Honeyhive - A Network Intrusion Detection System Framework Utilizing Distributed Internet Of Things Honeypot Sensors, Zachary D. Madison

Theses and Dissertations

Exploding over the past decade, the number of Internet of Things (IoT) devices connected to the Internet jumped from 3.8 billion in 2015 to 17.8 billion in 2018. Because so many IoT devices remain upatched, unmonitored, and left on, they have become a tantalizing target for attackers to gain network access or add another device to their botnet. HoneyHive is a framework that uses distributed IoT honeypots as Network Intrusion Detection Systems (NIDS) sensors that beacon back to a centralized Command and Control (C2) server. The tests in this experiment involve four types of scans and four levels of active …

Near Real-Time Zigbee Device Discrimination Using Cb-Dna Features, Yousuke Z. Matsui

Theses and Dissertations

Currently, Low-Rate Wireless Personal Area Networks (LR-WPAN) based on the Institute of Electrical and Electronics Engineers (IEEE) 802.15.4 standard are at risk due to open-source tools which allow bad actors to exploit unauthorized network access through various cyberattacks by falsifying bit-level credentials. This research investigates implementing a Radio Frequency (RF) air monitor to perform Near RealTime (NRT) discrimination of Zigbee devices using the IEEE 802.15.4 standard. The air monitor employed a Multiple Discriminant Analysis/Euclidean Distance classifier to discriminate Zigbee devices based upon Constellation-Based Distinct Native Attribute (CB-DNA) fingerprints. Through the use of CB-DNA fingerprints, Physical Layer (PHY) characteristics unique to …

Developing A Serious Game To Explore Joint All Domain Command And Control, Nathaniel W. Flack

Theses and Dissertations

Changes in the geopolitical landscape and increasing technological complexity have prompted the U.S. Military to coin Multi-Domain Operations (MDO) and Joint All-Domain Command and Control as terms to describe an over-arching strategy that frames the complexity of warfare across both traditional and emerging warfighting domains. Teaching new and advanced concepts associated with these terms requires both innovation as well as distinct education and training tools in order to realize the cultural change advocated by senior military leaders. BSN, a Collectible Card Game, was developed to teach concepts integral to MDO and initiate discussion on military strategy.

Automated Extraction Of Network Activity From Memory Resident Code, Austin Nicholas Sellers

LSU Master's Theses

Advancements in malware development, including the use of file-less and memory-only payloads, have led to a significant interest in the use of volatile memory analysis by digital forensics practitioners. Memory analysis can uncover a wealth of information not available via traditional analysis, such as the discovery of injected code, hooked APIs, and more. Unfortunately, the process of analyzing such malicious code is largely left to analysts who must manually reverse engineer the code to discover its intent. This task is not only slow and error-prone, but is also generally left only to senior-level analysts to perform, given that significant reverse …

All You Need To Know About Cybersecurity Ever! In 45 Minutes, Joe Beckman

Purdue Road School

This session will cover the information every local government official needs to know to keep their data safe from hackers.

Data Mining Of Chinese Social Networks: Factors That Indicate Post Deletion, Meisam Navaki Arefi

Computer Science ETDs

Widespread Chinese social media applications such as Sina Weibo (Chinese Twitter), the most popular social network in China, are widely known for monitoring and deleting posts to conform to Chinese government requirements. Censorship of Chinese social media is a complex process that involves many factors. There are multiple stakeholders and many different interests: economic, political, legal, personal, etc., which means that there is not a single strategy dictated by a single government authority. Moreover, sometimes Chinese social media do not follow the directives of government, out of concern that they are more strictly censoring than their competitors.

One crucial question …

Encryption Decrypted, Alex Ramsey

UNO Student Research and Creative Activity Fair

Encryption is a complex and bewildering process, yet it is absolutely foundational for secure and safe activities on the internet. Encryption, in its many forms, ultimately enables identity verification, password protection, secure conversation, cryptocurrency trade, and other online activities. Despite this widespread use, encryption is not a process easily explained to the layperson due to its complexity. Thus, the object of this research is to demystify the process of encryption and provide an understanding of one of the most common forms of modern encryption - RSA Encryption. This will be accomplished through the information provided on my poster as well …