Search

Little or no research has been directed to analysis and researching forensic analysis of the Bitcoin mixing or 'tumbling' service themselves. This work is intended to examine effective tooling and methodology for recovering forensic artifacts from two privacy focused mixing services namely Obscuro which uses the secure enclave on intel chips to provide enhanced confidentiality and Wasabi wallet which uses CoinJoin to mix and obfuscate crypto currencies. These wallets were set up on VMs and then several forensic tools used to examine these VM images for relevant forensic artifacts. These forensic tools were able to recover a broad range of forensic artifacts and found both network forensics and logging files to be a useful source of artifacts to deanonymize these mixing services., Comment: Accepted for publication in the International Conference on Data Analytics for Business and Industry (ICDABI) 2021 - (DATA'21)

The evolution of wireless and mobile communication from 0G to the upcoming 5G gives rise to data sharing through the Internet. This data transfer via open public networks are susceptible to several types of attacks. Encryption is a method that can protect information from hackers and hence confidential data can be secured through a cryptosystem. Due to the increased number of cyber attacks, encryption has become an important component of modern-day communication. In this article, a new image encryption algorithm is presented using chaos theory and dynamic substitution. The proposed scheme is based on two-dimensional Henon, Ikeda chaotic maps, and substitution box (S-box) transformation. Through Henon, a random S-Box is selected and the image pixel is substituted randomly. To analyze security and robustness of the proposed algorithm, several security tests such as information entropy, histogram investigation, correlation analysis, energy, homogeneity, and mean square error are performed. The entropy values of the test images are greater than 7.99 and the key space of the proposed algorithm is 2798. Furthermore, the correlation values of the encrypted images using the proposed scheme are close to zero when compared with other conventional schemes. The number of pixel change rate (NPCR) and unified average change intensity (UACI) for the proposed scheme are higher than 99.50% and 33, respectively. The simulation results and comparison with the state-of-the-art algorithms prove the efficiency and security of the proposed scheme.

Destination Advertisement Objects (DAOs) are sent upward by RPL nodes toward the DODAG root, to build the downward routing paths carrying traffic from the root to its associated nodes. This routing mechanism can be exploited by a malicious node periodically transmitting a large volume of DAO messages towards its parent, which in turn will forward such messages to its own parent and so on, until they arrive at the Direction-Oriented Directed Acyclic Graph (DODAG) root. This ultimately results in a negative effect on network performance in terms of energy consumption, latency and reliability. The first objective of this paper is to evaluate the effect of such a DAO attack in the context of an RPL IoT network. In particular, identifying the particular performance metrics and network resources affected most greatly. The second objective is the proposal of mitigating security mechanisms in relation to DAO attacks and to evaluate their effectiveness. The simulation results have shown how the attack can damage the network performance by significantly increasing the DAO overhead and power consumption. It also demonstrated that the DAO attack affect the reliability of the downward traffic under specific conditions. The proposed mechanisms showed a good capacity in restoring the optimal performance of the network by up to 205%, 181%, 87% and 6%, in terms of overhead, latency, power consumption and packet delivery ratio respectively.

In this paper, we present an empirical evaluation of 30 features used in touch-based continuous authentication. It is essential to identify the most significant features for each user, as behaviour is different amongst humans. Thus, a fixed feature set cannot be applied to all models. We highlight this importance by selecting features accordingly using our approach, seeking to individually select and empirically test the discriminative power of a range of features as well as feature interaction in the context of individual users. We test five different feature selection techniques: Mutual Information, Sequential Forward Selection, Sequential Floating Forward Selection, Sequential Backwards Selection, and Sequential Floating Backwards Selection. Our results show that a unique set of features can be selected for each user, while increasing or maintaining performance, i.e. up to 27 out of 30 features were removed for one user without affecting performance. We also show that distinctive features should be evaluated on a user basis, as particular features may be significant for some, while redundant for others. Moreover, for each user, the same features are selected for horizontal and vertical strokes while performance persists when using a horizontal model to predict vertical behaviour and vice versa.

The growing trend of sharing news/contents, through social media platforms and the World Wide Web has been seen to impact our perception of the truth, altering our views about politics, economics, relationships, needs and wants. This is because of the growing spread of misinformation and disinformation intentionally or unintentionally by individuals and organizations. This trend has grave political, social, ethical, and privacy implications for society due to 1) the rapid developments in the field of Machine Learning (ML) and Deep Learning (DL) algorithms in creating realistic-looking yet fake digital content (such as text, images, and videos), 2) the ability to customize the content feeds and to create a polarized so-called "filter-bubbles" leveraging the availability of the big-data. Therefore, there is an ethical need to combat the flow of fake content. This paper attempts to resolves some of the aspects of this combat by presenting a high-level overview of TRUSTD, a blockchain and collective signature based ecosystem to help content creators in getting their content backed by the community, and to help users judge on the credibility and correctness of these contents.

The growing spread of misinformation and dis-information has grave political, social, ethical, and privacy implications for society. Therefore, there is an ethical need to combat the flow of fake news. This paper attempts to resolves some of the aspects of this combat by presenting a high-level overview of TRUSTD, a blockchain and collective signature based ecosystem to help news creators getting their news backed by the community, and to help users to judge on the credibility and correctness of these news.

Compressive sensing is a compression technique that can be effectively utilised in multimedia encryption. This paper proposes a new compressive sensing image encryption scheme using the Secure Hash Algorithm (SHA-512), Discrete Cosine Transform (DCT), orthogonal matrix and discrete Chirikov map-based random permutation. DCT is applied on a plaintext image and a block of DCT coefficients is multiplied with an orthogonal matrix. Inverse DCT and scaling are performed to restrict the values between 0 and 255. Furthermore, values are shuffled using Chirikov-based pseudo-random permutation. A strong trade-off exists between DCT block size and computational efficiency. The quality and Signal to Noise Ratio (SNR) of the decrypted image decreases when the size of the DCT matrix is reduced, increasing the speed of the encryption algorithm. An extensive security analyses of the proposed scheme are performed, which establishes the robustness, computational efficiency and security of the technique against cryptographic attacks.

Several white papers have been published on general requirements for 5G in the health vertical. As 5G research and implementation continue more detailed real world information for application research are needed. This paper is focusing on the requirements for telemetric cardiac monitoring based on real world experiences from a joint project on early geriatric rehabilitation of elderly patients in a care of the elderly department after minimal invasive and conservative treatment in a highly specialized cardiology unit in Leipzig, Germany.

Emerging computing relies heavily on secure backend storage for the massive size of big data originating from the Internet of Things (IoT) smart devices to the Cloud-hosted web applications. Structured Query Language (SQL) Injection Attack (SQLIA) remains an intruder's exploit of choice to pilfer confidential data from the back-end database with damaging ramifications. The existing approaches were all before the new emerging computing in the context of the Internet big data mining and as such will lack the ability to cope with new signatures concealed in a large volume of web requests over time. Also, these existing approaches were strings lookup approaches aimed at on-premise application domain boundary, not applicable to roaming Cloud-hosted services' edge Software-Defined Network (SDN) to application endpoints with large web request hits. Using a Machine Learning (ML) approach provides scalable big data mining for SQLIA detection and prevention. Unfortunately, the absence of corpus to train a classifier is an issue well known in SQLIA research in applying Artificial Intelligence (AI) techniques. This paper presents an application context pattern-driven corpus to train a supervised learning model. The model is trained with ML algorithms of Two-Class Support Vector Machine (TC SVM) and Two-Class Logistic Regression (TC LR) implemented on Microsoft Azure Machine Learning (MAML) studio to mitigate SQLIA. This scheme presented here, then forms the subject of the empirical evaluation in Receiver Operating Characteristic (ROC) curve.

There are many risks in moving data into public storage environments, along with an increasing threat around large-scale data leakage. Secret sharing scheme has been proposed as a keyless and resilient mechanism to mitigate this, but scaling through large scale data infrastructure has remained the bane of using secret sharing scheme in big data storage and retrievals. This work applies secret sharing methods as used in cryptography to create robust and secure data storage and retrievals in conjunction with data fragmentation. It outlines two different methods of distributing data equally to storage locations as well as recovering them in such a manner that ensures consistent data availability irrespective of file size and type. Our experiments consist of two different methods — data and key shares. Using our experimental results, we were able to validate previous works on the effects of threshold on file recovery. Results obtained also revealed the varying effects of share writing to and retrieval from storage locations other than computer memory. The implication is that increase in fragment size at varying file and threshold sizes rather than add overheads to file recovery, do so on creation instead, underscoring the importance of choosing a varying fragment size as file size increases.

The back-end database is pivotal to the storage of the massive size of big data Internet exchanges stemming from cloud-hosted web applications to Internet of Things (IoT) smart devices. Structured Query Language (SQL) Injection Attack (SQLIA) remains an intruder's exploit of choice on vulnerable web applications to pilfer confidential data from the database with potentially damaging consequences. The existing solutions of mostly signature approaches were all before the recent challenges of big data mining and at such lacks the functionality and ability to cope with new signatures concealed in web requests. An alternative Machine Learning (ML) predictive analytics provides a functional and scalable mining to big data in detection and prevention of SQLIA. Unfortunately, lack of availability of readymade robust corpus or data set with patterns and historical data items to train a classifier are issues well known in SQLIA research. In this paper, we explore the generation of data set containing extraction from known attack patterns including SQL tokens and symbols present at injection points. Also, as a test case, we build a web application that expects dictionary word list as vector variables to demonstrate massive quantities of learning data. The data set is pre-processed, labelled and feature hashing for supervised learning. The trained classifier to be deployed as a web service that is consumed in a custom dot NET application implementing a web proxy Application Programming Interface (API) to intercept and accurately predict SQLIA in web requests thereby preventing malicious web requests from reaching the protected back-end database. This paper demonstrates a full proof of concept implementation of an ML predictive analytics and deployment of resultant web service that accurately predicts and prevents SQLIA with empirical evaluations presented in Confusion Matrix (CM) and Receiver Operating Curve (ROC).

Cloud-based systems are increasing being used to store sensitive documents, but which increasingly exposes them to the access from malicious entities. A major problem with this is that it is often difficult to apply access control policies which can be scaled into the Cloud. Along with this, modern cryptography methods tend to encrypt and control access to complete documents, and where, increasingly we need to control access to parts of a document. This paper outlines the integration of sticky policies that are embedded into OOXML (Open Office XML) and which protects each individual element of a data entity rather than the entire document, and without content granular access control. Finally it combines with modern public key Identity-Based Encryption (IBE) scheme to securely attach the sticky policy onto data.

Information security threat intelligence is a prevalent topic amongst researchers, long-established IT-vendors and start-ups. The possibilities of Big Data analytics to security threat and vulnerability scanning offer a significant development in the protection of infrastructures. At the same time, industry research reports continue to state that the main contributing factor in the events leading to a data breach is human error. The common response of information security professionals is to resort to technological solutions to prevent these human errors. However, some very important information security intelligence is not hidden within the network traffic: it's available from the people that work with sensitive information. This article describes the Health Information risk (HI-risk) method to identify non-technical information security risks in healthcare. The method includes risks related to skills, behaviour, processes, organisational culture, physical security, and external influences. HI-risk offers a solution to collect intelligence about nontechnical information security incidents from across the healthcare sector to demonstrate past trends and to be ahead of future incidents. A test of a HI-risk forecast proved the feasibility of this approach in healthcare and beyond. It is suggested that HI-risk could become a valuable addition to existing technical threat and vulnerability monitoring tools.

This paper proposes a secure document sharing construction, which addresses confidentiality and authenticity concerns related to cloud-based data sharing. The goal of this research is to find an efficient way to share data in the cloud across various security boundaries and in different access contexts for large enterprises as well as for small business market and private use. This work extends the popular Office Open XML (OOXML) document format with an eXtensible Access Control Mark-up Language (XACML) data piece, which defines a sticky-policy. The defined model leverages the original Identity Based Encryption (IBE) primitive properties by using sticky-policy to construct a public key. Research shows that Sticky-policy successfully followed the protected data in the cloud and only authorized subject accessed the data. Cryptographic operations on the client side during document encryption and decryption here were marginally faster than in other RSA based Information Rights Management IRM systems. Technologies used for proposed construction are not new, therefore only their unique combination with sticky-policy used as a public key constitutes novelty of this research.

Recent years have seen an astronomical rise in SQL Injection Attacks (SQLIAs) used to compromise the confidentiality, authentication and integrity of organisations' databases. Intruders becoming smarter in obfuscating web requests to evade detection combined with increasing volumes of web traffic from the Internet of Things (IoT), cloud-hosted and on-premise business applications have made it evident that the existing approaches of mostly static signature lack the ability to cope with novel signatures. A SQLIA detection and prevention solution can be achieved through exploring an alternative bio-inspired supervised learning approach that uses input of labelled dataset of numerical attributes in classifying true positives and negatives. We present in this paper a Numerical Encoding to Tame SQLIA (NETsQlIA) that implements a proof of concept for scalable numerical encoding of features to a dataset attributes with labelled class obtained from deep web traffic analysis. In the numerical attributes encoding: the model leverages proxy in the interception and decryption of web traffic. The intercepted web requests are then assembled for front-end SQL parsing and pattern matching by applying traditional Non-Deterministic Finite Automaton (NFA). This paper is intended for a technique of numerical attributes extraction of any size primed as an input dataset to an Artificial Neural Network (ANN) and statistical Machine Learning (ML) algorithms implemented using Two-Class Averaged Perceptron (TCAP) and Two-Class Logistic Regression (TCLR) respectively. This methodology then forms the subject of the empirical evaluation of the suitability of this model in the accurate classification of both legitimate web requests and SQLIA payloads.

Increasingly health records are stored in cloud-based systems, and often protected by a private key. Unfortunately the loss of this key can cause large-scale data loss. This paper outlines a novel Cloud-based architecture (SECRET) which supports keyless encryption methods and which can be used for the storage of patient information, along with supporting failover and a break-glass policy.

High performance group communication, such as broadcast, requires matching efficient broadcast algorithms to effective route discovery approach. Broadcast communication in MANETs is essential for a wide range of important applications. Nevertheless, existing broadcast schemes in MANETs suffer in terms of several issues such as rebroadcast redundancy and collisions. Consequently, this degrades the communication quality especially when dealing with high bandwidth applications. Thus, this paper adopts a new strategy that presents a new distributed route discovery (DRD) scheme to handle the broadcast operation efficiently by reducing the number of the broadcast redundancy request (RREQ) packets and the number of collision and contentions. We examined the performance of the proposed scheme DRD in MANETs; in terms of RREQ rebroadcast number and RREQ collision number. Our experiments confirm the superiority of the proposed scheme over its counterparts in different communication constraints.

We present a cloud-based healthcare system that integrates a formal care system (DACAR) with an informal care system (Microsoft Health Vault). The system provides high levels of security and privacy within a cloud environment, enabling sharing of both health records and the access rights, along the patient pathway. We also define a case study that can help in evaluating and in demonstrating the usefulness of a cloud-based integrated health care system.

The use of digital technologies in providing health care services is collectively known as eHealth. Considerable progress has been made in the development of eHealth services, but concerns over service integration, large scale deployment, and security, integrity and confidentiality of sensitive medical data still need to be addressed. This paper presents a solution proposed by the Data Capture and Auto Identification Reference (DACAR) project to overcoming these challenges. The key contributions of this paper include a Single Point of Contact (SPoC), a novel rule based information sharing policy syntax, and Data Buckets hosted by a scalable and cost-effective Cloud infrastructure. These key components and other system services constitute DACAR's eHealth platform, which allows the secure capture, storage and consumption of sensitive health care data. Currently, a prototype of the DACAR platform has been implemented. To assess the viability and performance of the platform, a demonstration application, namely the Early Warning Score (EWS), has been developed and deployed within a private Cloud infrastructure at Edinburgh Napier University. Simulated experimental results show that the end-to-end communication latency of 97.8% of application messages were below 100ms. Hence, the DACAR platform is efficient enough to support the development and integration of time critical eHealth services. A more comprehensive evaluation of the DACAR platform in a real life clinical environment is under development at Chelsea & Westminster Hospital in London.

Current1 investigative data acquisition techniques often breach human and natural rights of the data subject and can jeopardize an investigation. Often the investigators need to reveal to the data controller precise details of their suspect's identity or suspect's profile. In this research a novel approach to investigative data acquisition is presented and privacy preserving Investigative Data Acquisition Protocol (IDAP) is defined. This protocol is the first that allows for performing private information retrieval of records matching multiple selection criteria.

Mobile ad hoc networks (MANETs) have been gaining tremendous attention owing to the advances in wireless technologies accompanied by many applications and implementations. However, there are still a number of issues in MANETs which require further investigations and efficient solutions. Out of these issues, broadcasting in MANETs has been a major problem for both industry and the research community. The broadcast communication is usually required to disseminate a message to all the nodes of a network. This operation is highly required in MANETs to distribute necessary information and ensure efficient control and coordination over the network nodes. However, broadcasting in MANETs is usually susceptible to several challenging communication issues, including, flooding, packets contentions and collisions, i.e., these problems all together are called the Broadcast Storm Problem (BSP). Despite a number of suggested solutions for BSP, the probabilistic scheme is considered the most promising solution due to its simplicity and suitability for MANETs. Under the umbrella of this scheme, many dynamic probabilistic broadcasting algorithms have been proposed in the literature to solve the BSP. However, most of them are not suitable for many applications including those real life scenarios as there are many limitations such as the probability of rebroadcasting operation and thresholds rebroadcasting permission, which is caused by collecting local neighbourhoods' connectivity by broadcasting HELLO packets. In an attempt to enhance and promote the quality of the probabilistic scheme, this paper proposes a new probabilistic approach to overcome these limitations. Our proposed approach is augmented with a well-know ad hoc routing protocols including Ad hoc On demand Distance Victor protocol (AODV). We have conducted intensive simulation experiments under different operating condition. The simulation results show that our proposed approach outperforms its counterparts including the well known blind flooding, fixed probabilistic and traditional dynamic probabilistic approaches.

In the vast majority of ad-hoc routing protocols, the hop-counting mechanisms for identifying the optimal route are dominant. However, this approach oversimplifies such a complex decision by ignoring the fact that participating devices may have considerably unequal performance characteristics and current utilisation status. Accordingly, it is possible for an optimal route to be composed of devices with high utilisation status, or, low battery reserves, which results in an overall unreliable route. This research work tackles this by identifying the best metrics that can describe any route within a graph, in terms of overall throughput, reliability, and minimum energy consumption. Simulations were carried out by varying critical factors of mobile devices such as battery reserves, memory and CPU utilisation, and results recorded the effect that this has on the device's overall routing metric. This paper also presents the threshold values, which turn the device from routing-capable to routing-incapable state.

This paper focuses on high false-positive rate of attacks. First, the merits and demerits of research work in curbing false positive rate of attacks in intrusion detection systems (IDSs) are discussed. Then we present our research efforts in the form of an IDS called NetHost-Sensor, recap on past NetHost-Sensor research contributions and discusses in detail its novel procedure analysis technique in curbing false-positive. We discuss in detail, the NetHost-Sensor methodology, its procedure analysis technique and report on our experimental investigation that shows the reduction of false-positives, using HTTP network communication as a medium for analysis. Finally, we validate our research work by comparing false-positives with Snort IDS

Multi-hop ad-hoc routing is a challenging issue, because of the dynamic network topology, and limited capabilities of resource-constrained mobile devices. This paper proposes a metric-driven clustering organisation of participating nodes which provides an effective way to reduce network overhead, in contrast to traditional flooding methods. This novel method creates a network backbone for data routing and location management, which is composed of the fittest nodes. The key metrics are: mobility, buffering capabilities, throughput, network state, utilisation, and battery reserves. The paper presents the overall agent-based model, and describes the adaptability of the cluster-head metrics, and the automated reconfigurability of an ad-hoc network.

Ad-hoc wireless networks, which use ad-hoc routing methods may prove a good solution in certain applications, especially where networks have to be constructed where there is no possibly of creating a network backbone, and in emergency situations. They may also lead to more flexible networks, which require reduced configuration, and allow for optimised routes. There is thus a requirement to use mobile devices as intermediate routing devices, which forward data from one device to another. One of the best methods is to run a proxy server on the mobile device, as it allows for a simple implementation on the device. A key factor in this is determining the fitness of a mobile device, especially a limited one, such as a handheld PDA. This paper discusses the metrics that could be used to assess the potential of devices and their environment to route certain types of data, and presents results from iPAQ devices using a range of differing operating systems. It shows how performance of a proxy device varies depending on several factors including the Java environment used, and the operating system used. The paper shows that Linux versions for handheld devices out-perform the equivalent Windows systems for the key performance metrics for proxy devices, such as battery usage and network performance.

Many computing-related programmes and modules have many problems caused with large class sizes, large-scale plagiarism, module franchising, and an increasing requirement from students for increased amounts of hands-on, practical work. This paper presents a practical computer networks module which uses a mixture of on-line examinations and a practical skills-based test to assess student performance. Many academics have observed a strong link between examination and coursework performance, where academically strong students generally work hard for both examinations and courseworks. This paper shows that it is possible to design hand-on practicals which have a strong correlation between performance in practical skills-based tests and in examination-type assessments. The paper shows results which grades students for two on-line, multiple choice tests, and then analyses the average time these students take to complete a practical on-line test It shows that, on average, the average time taken to complete the test increases for weaker students. Along with this the paper shows that female students in the practical test out-perform male students by a factor of 25%.

This paper focuses on the design and development of a novel architecture called MARIAN, which utilises static agents, mobile agents, and also a hybrid approach, in order to perform routing, network discovery, and automatic network reconfiguration, in wireless ad-hoc networks. The paper shows that, in most cases, the static agent approach is faster than the mobile agent approach in retrieving data from a wireless remote database. However, if the amount of data to be retrieved is relatively large, such as in the gathering of data for routing information, the mobile agents are more capable of filtering data according to the required preferences. It also shows that the time taken to gather routing information can be significantly reduced using a mobile agent approach, as compared with the static agent approach.