Information Security Commons^™

Analysis Of Blockchain Protocol Against Static Adversarial Miners Corrupted By Long Delay Attackers, Quan Yuan, Puwen Wei, Keting Jia, Haiyang Xue

Research Collection School Of Computing and Information Systems

Bitcoin, which was initially introduced by Nakamoto, is the most disruptive and impactive cryptocurrency. The core Bitcoin technology is the so-called blockchain protocol. In recent years, several studies have focused on rigorous analyses of the security of Nakamoto’s blockchain protocol in an asynchronous network where network delay must be considered. Wei, Yuan, and Zheng investigated the effect of a long delay attack against Nakamoto’s blockchain protocol. However, their proof only holds in the honest miner setting. In this study, we improve Wei, Yuan and Zheng’s result using a stronger model where the adversary can perform long delay attacks and corrupt …

Does Reputational Sanctions Deter Negligence In Information Security Management? A Field Quasi-Experiment, Qian Tang, Andrew B. Whinston

Research Collection School Of Computing and Information Systems

Security negligence, a major cause of data breaches, occurs when an organization’s information technology management fails to adequately address security vulnerabilities. By conducting a field quasi-experiment using outgoing spam as a focal security issue, this study investigates the effectiveness of reputational sanctions in reducing security negligence in a global context. In the quasi-experiment, a reputational sanction mechanism based on outgoing spam was established for four countries, and for each country, reputational sanctions were imposed on the 10 organizations with the largest outgoing spam volumes—that is, these organizations were listed publicly. We find that because of our reputational sanction mechanism, organizations …

Example-Based Colourization Via Dense Encoding Pyramids, Chufeng Xiao, Chu Han, Zhuming Zhang, Jing Qin, Tien-Tsin Wong, Guoqiang Han, Shengfeng He

Research Collection School Of Computing and Information Systems

We propose a novel deep example-based image colourization method called dense encoding pyramid network. In our study, we define the colourization as a multinomial classification problem. Given a greyscale image and a reference image, the proposed network leverages large-scale data and then predicts colours by analysing the colour distribution of the reference image. We design the network as a pyramid structure in order to exploit the inherent multi-scale, pyramidal hierarchy of colour representations. Between two adjacent levels, we propose a hierarchical decoder-encoder filter to pass the colour distributions from the lower level to higher level in order to take both …

Divergent Student Views Of Cybersecurity, Susan E. Ramlo, John B. Nicholas

Journal of Cybersecurity Education, Research and Practice

Cybersecurity is a worldwide issue and concern. Prior studies indicate that many people do not use cybersecurity best practices. Although these prior studies used large-scale surveys or interviews, this study used Q methodology [Q] because Q provides greater insight than Likert-format surveys. In fact, Q was created to scientifically study subjectivity. Within a Q study, various stages as well as philosophical, epistemological, and ontological principles represent a complete methodology. At first, Q researchers collect items that represent the broad range of communications about the topic (called the concourse). Although the items can be pictures, scents, or other means of communication, …

Teaching About The Dark Web In Criminal Justice Or Related Programs At The Community College And University Levels., Scott H. Belshaw, Brooke Nodeland, Lorrin Underwood, Alexandrea Colaiuta

Journal of Cybersecurity Education, Research and Practice

Increasingly, criminal justice practitioners have been called on to help solve breaches in cyber security. However, while the demand for criminal justice participation in cyber investigations increases daily, most universities are lagging in their educational and training opportunities for students entering the criminal justice fields. This article discusses the need to incorporate courses discussing the Dark Web in criminal justice. A review of existing cyber-criminal justice programs in Texas and nationally suggests that most community colleges and 4-year universities have yet to develop courses/programs in understanding and investigating the Dark Web on the internet. The Dark Web serves as the …

An Assessment Of Practical Hands-On Lab Activities In Network Security Management, Te-Shun Chou, Nicholas Hempenius

Journal of Cybersecurity Education, Research and Practice

With the advancement in technology over the past decades, networks have become increasingly large and complex. In the meantime, cyberattacks have become highly sophisticated making them difficult to detect. These changes make securing a network more challenging than ever before. Hence, it is critical to prepare a comprehensive guide of network security management for students assist them in becoming network security professionals.

The objective of this paper is to introduce a variety of techniques related to network security management, such as Simple Network Management Protocol (SNMP), event management, security policy management, risk management, access control, and remote monitoring. With the …

Key Regeneration-Free Ciphertext-Policy Attribute-Based Encryption And Its Application, Hui Cui, Robert H. Deng, Baodong Qin, Jian Weng

Research Collection School Of Computing and Information Systems

Attribute-based encryption (ABE) provides a promising solution for enabling scalable access control over encrypted data stored in the untrusted servers (e.g., cloud) due to its ability to perform data encryption and decryption defined over descriptive attributes. In order to bind different components which correspond to different attributes in a user's attribute-based decryption key together, key randomization technique has been applied in most existing ABE schemes. This randomization method, however, also empowers a user the capability of regenerating a newly randomized decryption key over a subset of the attributes associated with the original decryption key. Because key randomization breaks the linkage …

Game Theoretical Study On Client-Controlled Cloud Data Deduplication, Xueqin Liang, Zheng Yan, Robert H. Deng

Research Collection School Of Computing and Information Systems

Data deduplication eliminates redundant data and is receiving increasing attention in cloud storage services due to the proliferation of big data and the demand for efficient storage. Data deduplication not only requires a consummate technological designing, but also involves multiple parties with conflict interests. Thus, how to design incentive mechanisms and study their acceptance by all relevant stakeholders remain important open issues. In this paper, we detail the payoff structure of a client-controlled deduplication scheme and analyze the feasibilities of unified discount and individualized discount under this structure. Through game theoretical study, a privacy-preserving individualized discount-based incentive mechanism is further …

Interpretability Of Api Call Topic Models: An Exploratory Study, Puntitra Glendowne, Dae Glendowne

Faculty Publications

Topic modeling is an unsupervised method for discovering semantically coherent combinations of words, called topics, in unstructured text. However, the human interpretability of topics discovered from non-natural language corpora, specifically Windows API call logs, is unknown. Our objective is to explore the coherence of topics and their ability to represent the themes of API calls from malware analysts’ perspective. Three Latent Dirichlet Allocation (LDA) models were fit to a collection of dynamic API call logs. Topics, or behavioral themes, were manually evaluated by malware analysts. The results were compared to existing automated quality measures. Participants were able to accurately determine …

Dronesig: Lightweight Digital Signature Protocol For Micro Aerial Vehicles, Yucheng Li

Theses, Dissertations and Capstones

Micro aerial vehicles a.k.a. drones, have become an integral part of a variety of civilian and military application domains, including but not limited to aerial surveying and mapping, aerial surveillance and security, aerial inspection of infrastructure, and aerial delivery. Meanwhile, the cybersecurity of drones is gaining significant attention due to both financial and strategic information and value involved in aerial applications. As a result of the lack of security features in the communication protocol, an adversary can easily interfere with on-going communications or even seize control of the drone. In this thesis, we propose a lightweight digital signature protocol, also …

Mind The Gap: Understanding Stakeholder Reactions To Different Types Of Data Security, Audra Diers-Lawson, Amelia Symons

International Crisis and Risk Communication Conference

Data security breaches are an increasingly common problem for organizations, yet there are critical gaps in our understanding of how different stakeholders understand and evaluate organizations that have experienced these kinds of security breaches. While organizations have developed relatively standard approaches to responding to security breaches that: (1) acknowledge the situation; (2) highlight how much they value their stakeholders’ privacy and private information; and (3) focus on correcting and preventing the problem in the future, the effectiveness of this response strategy and factors influencing it have not been adequately explored. This experiment focuses on a 2 (type of organization) x …

Data And Artificial Intelligence: Mismatch Between Expectations And Uses, Diana Garcia

Cybersecurity Undergraduate Research Showcase

People like to hide behind their phones when it comes to social media. Not every user has their real name or their own photo on display in their social media account. To obfuscate their identities, some users use unusual usernames and profile photos that are divorced from their true identity.

The Interdisciplinary Impacts Of Technology Semantics And Communicational Bypassing In The Cybersecurity Field, Brooke Nixon

Cybersecurity Undergraduate Research Showcase

In 2012, former director of the Federal Bureau of Investigation (FBI) Robert Mueller shocked many when he warned, “[t]here are only two types of companies: those that have been hacked and those that will be.” As technology and information systems develop rapidly, security has become a topic of increasing interest and concern. In 2018, it was noted that the total cost to account for cybercrime on a global scale surpassed US$1 billion (Milkovich, 2020). In the United States, a hacker attack occurs every 39 seconds, and each year, 1 in 3 Americans are personally impacted by a form of hacking …

The Cyberworld And Human Trafficking: A Double-Edged Sword, Bridget Dukes

Cybersecurity Undergraduate Research Showcase

This report examines the advantages and disadvantages associated with the growth of technology within the United States, specifically how technology, digital literacy, and cybersecurity can be used to both facilitate and combat sex trafficking and sexual exploitation on the Internet. The first part of the report addresses trafficking statistics in the United States, as well as legal intervention the country has taken against this epidemic, including an explanation of the Trafficking Victims Prevention Act and the FOSTA-SESTA bill. The second part of the report addresses the online recruitment of buyers and sellers, as well as how the use of open-source …

Topical Review Of Vulnerability Management For Local Hampton Roads Industry, Gregory W. Hubbard Jr., Matthew Eunice

OUR Journal: ODU Undergraduate Research Journal

The progress towards an interconnected digital world offers an exciting level of advancement for humanity. Unfortunately, this “online” connection is not safe from the threats and dangers typically associated with physical operations. With the foundation of Cyber Command of DoD cyberspace, the United States Government is taking a prominent stance in cyberspace operations. Like the federal government, both industries and individuals are not immune and are oftentimes unknowingly at risk to cyberattack. This report hopes to bring awareness to common vulnerabilities in multi-user networks by describing a historical background on cyber security as well as outlining current methods of vulnerability …

Improving The Security Of Critical Infrastructure: Metrics, Measurements, And Analysis, Jeman Park

Electronic Theses and Dissertations, 2020-2023

In this work, we propose three important contributions needed in the process of improving the security of the critical infrastructure: metrics, measurement, and analysis. To improve security, metrics are key to ensuring the accuracy of the assessment and evaluation. Measurements are the core of the process of identifying the causality and effectiveness of various behaviors, and accurate measurement with the right assumptions is a cornerstone for accurate analysis. Finally, contextualized analysis essential for understanding measurements. Different results can be derived for the same data according to the analysis method, and it can serve as a basis for understanding and improving …

Initiating A Collaborative Cybersecurity Governance Framework At The State Level, Autum C. Pylant

West Chester University Doctoral Projects

Cybersecurity risk is dynamic and rapidly evolving. Today, cyber incidents can significantly impair government operations, erode public confidence, undermine operations of critical infrastructures, and put citizen data and whole industries at risk. Managing these risks to cyber assets must be part of a state’s overall risk management portfolio. To do this successfully, state leaders must have effective cybersecurity governance. To achieve this, governors and state legislatures must ensure that their states have the essential governance mechanisms necessary for understanding and managing cybersecurity risk and for translating awareness about cyber threats into action. This dissertation gives an overview of three different …

Study Of The Feasibility Of A Virtual Environment For Home User Cybersecurity, Sean Powell

OUR Journal: ODU Undergraduate Research Journal

This research focuses on the average home computer user’s ability to download, install and manage a virtual machine software program. The findings of this research is to be used as a foundation to the possibility of using a virtual machine software program as another form of defense for the home user’s computer. Virtual machines already have various uses, some in the cybersecurity field; this possibility could add another useful application for the software program. This research is conducted by monitoring volunteers’ ability to download, install, set up, and perform basic instructions on the virtual environment. It was from the volunteers’ …

Interdisciplinary Cybersecurity For Resilient Cyberdefense, Rachid Ait Maalem Lahcen

Electronic Theses and Dissertations, 2020-2023

Cybersecurity's role is to protect confidentiality, integrity, and availability of enterprise assets. Confidentiality secures data from theft, integrity mitigates modification of data in a malicious way, and availability assures continuation of systems' access and services. However, achieving these goals is difficult due to the mushrooming of various cyber attackers that come from individuals or state actors with motives ranging from ideological, financial, state-sponsored espionage, revenge, or simple curiosity and boredom. The difficulty also lies in the complexity of the cyber layers that are not well studied. Layers that interconnect and require effective communication and collaboration. This effectiveness is still lacking …

A User-Centric And Sentiment Aware Privacy-Disclosure Detection Framework Based On Multi-Input Neural Network, A. K. M. Nuhil Mehdy, Hoda Mehrpouyan

Computer Science Faculty Publications and Presentations

Data and information privacy is a major concern of today’s world. More specifically, users’ digital privacy has become one of the most important issues to deal with, as advancements are being made in information sharing technology. An increasing number of users are sharing information through text messages, emails, and social media without proper awareness of privacy threats and their consequences. One approach to prevent the disclosure of private information is to identify them in a conversation and warn the dispatcher before the conveyance happens between the sender and the receiver. Another way of preventing information (sensitive) loss might be to …