Search

Honeyword (or decoy password) based authentication, first introduced by Juels and Rivest in 2013, has emerged as a security mechanism that can provide security against server-side threats on the password-files. From the theoretical perspective, this security mechanism reduces attackers’ efficiency to a great extent as it detects the threat on a password-file so that the system administrator can be notified almost immediately as an attacker tries to take advantage of the compromised file. This paper aims to present a comprehensive survey of the relevant research and technological developments in honeyword-based authentication techniques. We cover twenty-three techniques related to honeyword, reported under different research articles since 2013. This survey paper helps the readers to (i) understand how honeyword based security mechanism works in practice, (ii) get a comparative view on the existing honeyword based techniques, and (iii) identify the existing gaps that have yet to be filled and the emergent research opportunities.

Pollution is one of the major threats for the environment as well as society. It causes severe problems for the living organisms and can gives birth of various unknown issues. Different sources like cars, industrial belts, fossil fuels etc. are the major causes of air pollution. Different researchers are working to develop new methods to combat air pollution. In this work, a new solution is proposed to fight against air pollution. The proposed solution is based on nanotechnology which not only fight against the air pollution but, it can generate electricity using the nanostructured carbon materials. The proposed solution can be deployed in real life scenario to reduce the air pollution and produce electricity in a large scale to provide an alternate energy resource to the society.

Side channel attacks, based on the human behavior, have not received much attention in the domain of recording attack resilient unaided authentication services (RARUAS) that purely rely on human visual perception but not on hidden auxiliary channels. In this paper, for the first time, we have made an extensive analysis to show - how human behavior during the login can weaken the claimed security standard of RARUAS. We identify this threat as behavioral side channel attack. To make situation more alarming, our investigation revealed that the identified threat model is capable of reducing the claimed session resiliency of any RARUAS by a significant extent. For dealing with this threat model, the latter part of our proposal introduces a novel defense strategy that reduces attackers’ efficiency and improves the session resiliency. The subsequent study indicates that by nature of its design, the proposed defense strategy does not make any significant impact on the usability standard. To validate our claims, we have made a thorough experimental study to show that the proposed defense strategy is truly deployable in practice for improving the situation against the behavioral side channel attack.

In predictive tasks like classification, Information Gain (IG) based Decision Tree is very popularly used. However, IG method has some inherent problems like its preference towards choosing attributes with higher number of distinct values as the splitting attribute in case of nominal attributes and another problem is associated with imbalanced datasets. Most of the real-world datasets have many nominal attributes, and those nominal attributes may have many number of distinct values. In this paper, we have tried to point out these characteristics of the datasets while discussing the performance of our proposed approach. Our approach is a variant of the traditional Decision Tree model and uses a new technique called Dispersion_Ratio, a modification of existing Correlation Ratio (CR) method. The whole approach is divided into two phases - firstly, the dataset is discretised using a discretization module and secondly, the preprocessed dataset is used to build a Dispersion Ratio based Decision Tree model. The proposed method does not prefer the attributes with many unique values and indifferent about class distribution. It performs better than previously proposed CR based Decision Tree (CRDT) Model since an efficient discretization module has been added with it. We have evaluated the performance of our approach on some benchmark datasets from various domains to demonstrate the effectiveness of the proposed technique and also compared our model with Information Gain, Gain Ratio and Gini Index based models. Result shows that the proposed model outperforms other models in majority of the cases that we have considered in our experiment.

Unaided authentication services provide the flexibility to login without being dependent on any external hardware. n-Session recording attack resilient unaided authentication services (n-SRRUASs) are known for setting high security standards against different client side threats. However, because of their authentication procedure, the authors have identified that these services cope poorly with handling the server side issues. Though modern days' research heavily depends on the honeywords (or fake passwords) as a countermeasure of server side threats, they have shown that the honeywords cannot be directly applied to n-SRRUAS. The authors' analysis shows that the idea of incorporating the honeywords directly into an n-SRRUAS is particularly difficult as it prevents the system from storing passwords after applying password-based key derivation function or in the form of a hashed string. In this study, they have proposed few generic principles for incorporating the honeywords into n-SRRUAS and show that the proposed principles are sufficient for incorporating the honeywords into any n-SRRUAS. Furthermore, with the help of an existing n-SRRUAS, they have shown that the proposed idea is truly implementable in practice to fill the existing gap.

In the domain of password security, research has made significant progress in handling different kinds of threats which require human intelligence factor to fix the vulnerabilities. In spite of having strong theoretical establishments, most of these defense mechanisms cannot be used in practice as humans have limitations in processing complex information. The little bit of good news is that very few research proposals in this field have shown the promises to be deployable in practice. This paper focuses on such one method - proposed by Roth et al. back in 2004, which provides adequate user-friendliness to enter Personal Identification Number (PIN) securely in the presence of human shoulder surfers. Surprisingly, the background algorithm of this method for validating users’ responses runs in linear time on a search space of cardinality 5 and hence, the validation process does not put much load on the authenticating device. Therefore, such human identification protocol can also be integrated into the IoT infrastructure for conducting a more secured login from the client-side. Having such advantages, though remained secure for almost ten years after its release in 2004, recently, few proposals revealed some serious vulnerable aspects of the Roth et al. ’s proposal. In this paper, we have taken an attempt to save this user-friendly form of authentication. Firstly, we have made a critical discussion on the importance of the targeted PIN entry method in the domain of usable security and then given a brief overview of the identified limitations of this protocol. Followed by this, a few initiatives have been taken to fix the identified vulnerabilities of Roth et al. ’s proposal by revising its working principle, while the login procedure and the usability standard of this method stay unaffected.

Inverting hashed passwords by performing brute force computation is one of the latest security threats on password based authentication technique. New technologies are being developed for reducing complexity of brute force computation and these increase the success rate of inversion attack. Honeyword base authentication protocol can successfully mitigate this threat by making password cracking detectable. However, existing honeyword based methods have several limitations likeMultiple System Vulnerability, Weak DoS Resistivity, Storage Overhead, etc. In this paper, we have proposed a new modified-UI based honeyword generation approach, identified as Paired Distance Protocol (PDP), which overcomes most of the drawbacks of previously proposed honeyword generation approaches. The comprehensive analysis shows that PDP not only attains a high detection rate of 97.23%, but also reduces the storage overhead to a great extent.

Entity matching is to map the records in a database to their corresponding entities. It is a well-known problem in the field of database and artificial intelligence. In digital libraries such as DBLP, ArnetMiner, Google Scholar, Scopus, Web of Science, AllMusic, IMDB, etc., some of the attributes may evolve over time, i.e., they change their values at different instants of time. For example, affiliation and email-id of an author in bibliographic databases which maintain publication details of various authors like DBLP, ArnetMiner, etc. may change their values. A taxpayer can change his or her address over time. Sometimes people change their surnames due to marriage. When a database contains records of these natures and the number of records grows beyond a limit, then it becomes really challenging to identify which records belong to which entity due to the lack of a proper key. In the current paper, the problem of automatic partitioning of records is posed as an optimization problem. Thereafter, a genetic algorithm based automatic technique is proposed to solve the entity matching problem. The proposed approach is able to automatically determine the number of partitions available in a bibliographic dataset. A comparative analysis with the two existing systems – DBLP and ArnetMiner, over sixteen bibliographic datasets proves the efficacy of the proposed approach.

The worldwide energy consumption has been growing in aggregate at a tremendous rate, and a majority of the same is due to heating ventilation air conditioning (HVAC) loads in urban buildings. With the help of the recent advances in energy management and optimization techniques, the operations and functioning of these devices can now be managed and controlled efficiently for an improved energy consumption scenario and thereby reducing cost. In this article, we propose a multiobjective optimal scheduling framework based on Johnson's elementary circuit finding algorithm for controlling HVAC devices, specifically for buildings that require continuous thermal comfort maintenance. Two primary objectives addressed in this article are: minimizing power fluctuation and maximizing thermal comfortability of the users. We use standard comfortability indices to quantify thermal comfortability. To reduce the computation time, we also propose two intelligent improvement schemes that prune the exponential search space of Johnson's algorithm. Furthermore, a new greedy scheduling algorithm has been proposed to obtain near-optimal solutions efficiently. All the proposed approaches have been studied in a simulated environment depicting a real-world scenario to evaluate their efficiency and effectiveness for practical implementations, including a comparative analysis with Karp's minimum mean cycle algorithm in this problem setup.

Multiobjective based solution framework for entity matching.Bibliographic database is used.Automatic determination of number of clusters and partitions.New encoding strategy, new mutation operators are explored.Several distance measures and cluster validity indices are used. With the increasing use of on-line resources, the size of the bibliographic database is growing day by day. The available huge amount of data belong to various entities. It is difficult to automatically identify the records which belong to a particular entity. Mapping the records to the corresponding entity is termed as the entity matching problem. In bibliographic database many attributes change over time. For example - affiliation of an author changes frequently. Many authors generally use different email-ids. The names of co-authors also change with time. All these aspects have made the entity matching problem challenging. Generally an entity matching task is carried out by constructing a feature vector to represent a record, then a classifier is trained to classify each feature vector. But for bibliographic database it is very difficult and time consuming to generate some manually annotated labeled data to train a classifier. Inspired by this observation, we have proposed an unsupervised approach for entity matching problem using non-dominated sorting genetic algorithm-II (NSGA-II). A new encoding strategy is used to encode the clusters in the form of a chromosome. New mutation and crossover operators are proposed which are suitable for bibliographic data clustering. Different distance measures are used to measure the dissimilarities between records. Finally, solutions are evolved using the search capability of NSGA-II. Experimental evaluations are carried out with 247 different combinations of eight objective functions for eight different bibliographic datasets. A comparative analysis with two existing systems - DBLP and ArnetMiner, shows that the proposed technique can produce better results in many cases.

Shoulder surfing attack is a great threat on password based authentication technique. As today's world has seen a rapid growth of mobile users thus, latest methodologies which are developed to address this attack preferably should support mobile users. In this paper we have proposed a new shoulder surfing resilient technique, MobSecure, which is designed to be used in smartphone and acts in a partially observable environment (where an auxiliary device is required for authentication). Additionally the proposed method is also capable of avoiding recording based attack for infinite number of authentication sessions. Allowing alphanumeric characters as password is one of the key properties of the proposed scheme here. Finally, we show that MobSecure attains highest security standard with moderate usability scores compared to existing partially observable approaches.

Password based authentication shows its vulnerability against inversion attack model in which adversary obtains plaintext password from its corresponding hashed value. To cope up with such attack, honeyword based authentication technique is introduced. In this technique, along with the original password of user, some dummy passwords or honeywords are also stored. Although this technique is good enough to address the aforementioned security breach, but use of additional storage to store the honeywords is still an overhead associated with such approach. In this paper, we have proposed few directions to minimize the storage cost of some of the existing honeyword generation approaches. We have even found that in some cases no additional storage overhead is required. A comparative analysis at the end also shows that the proposed techniques are able to raise some of the security features compared to existing honeyword generation approaches.

The phenomenal growth in the healthcare data has inspired us in investigating robust and scalable models for data mining. For classification problems Information Gain(IG) based Decision Tree is one of the popular choices. However, depending upon the nature of the dataset, IG based Decision Tree may not always perform well as it prefers the attribute with more number of distinct values as the splitting attribute. Healthcare datasets generally have many attributes and each attribute generally has many distinct values. In this paper, we have tried to focus on this characteristics of the datasets while analysing the performance of our proposed approach which is a variant of Decision Tree model and uses the concept of Correlation Ratio(CR). Unlike IG based approach, this CR based approach has no biasness towards the attribute with more number of distinct values. We have applied our model on some benchmark healthcare datasets to show the effectiveness of the proposed technique.

Security analysis is a formal verification technique to ascertain certain desirable guarantees on the access control policy specification. Given a set of access control policies, a general safety requirement in such a system is to determine whether a desirable property is satisfied in all the reachable states. Such an analysis calls for the use of formal verification techniques. While formal analysis on traditional Role Based Access Control (RBAC) has been done to some extent, recent extensions to RBAC lack such an analysis. In this paper, we consider the temporal RBAC extensions and propose a formal technique using timed automata to perform security analysis by analyzing both safety and liveness properties. Using safety properties one ensures that something bad never happens while liveness properties show that some good state is also achieved. GTRBAC is a well accepted generalized temporal RBAC model which can handle a wide range of temporal constraints while specifying different access control policies. Analysis of such a model involves a process of mapping a GTRBAC based system into a state transition system. Different reduction rules are proposed to simplify the modeling process depending upon the constraints supported by the system. The effect of different constraints on the modeling process is also studied.

This work describes a novel system for device development that automates and fully integrates the workflow from test chip construction, from placement and routing to electrical test program generation. In addition to accelerating test chip and test program development, this system facilitates parameterized data analysis, thereby providing a framework that finally allows the user to realize the full benefits of complex and elegant experimental device designs. By utilizing a centralized database and eliminating parameter re-entry, the automation provided by this integrated approach eliminates many of the sources for human error while maximizing reuse between technologies.

Non-domination level update problem is to sort the non-dominated fronts after insertion or deletion of a solution. Generally the solution to this problem requires to perform the complete non-dominated sorting which is too expensive in terms of number of comparisons. Recently an Efficient Non-domination Level Update (ENLU) approach is proposed which does not perform the complete sorting. For this purpose, in this paper a space efficient version of ENLU approach is proposed without compromising the number of comparisons. However this approach does not work satisfactorily in all the cases. So we have also proposed another tree based approach for solving this non-domination level update problem. In case of insertion, the tree based approach always checks for same number of fronts unlike linear approach in which the number of fronts to be checked depends on the inserted solution. The result shows that in case where all the solutions are dominating in nature the maximum number of comparisons using tree based approach is $\mathcal{O}(\log N)$ as opposed to $\mathcal{O}(N)$ in ENLU approach. When all the solutions are equally divided into $K$ fronts such that each solution in a front is dominated by all the solutions in the previous front then the maximum number of comparisons to find a deleted solution in case of tree based approach is $K{-}\log K$ less than that of ENLU approach. Using these approaches an on-line sorting algorithm is also proposed and the competitive analysis of this algorithm is also presented., Comment: 18 pages and 6 figures