Search

According to the Internet usage statistics published on June 2019, around 59% of the world’s human population uses the Internet. The web browser is one of the most used applications to access the Internet. How many of these 59% population trust the browser and the environment they are using? Thus, there is a necessity to configure the browser for secure browsing as well as the configuration and the browsing system needs to be protected from malicious intent and process. The paper proposes an architecture based on a trusted platform module (TPM) to configure the browser for secure browsing and to provide trust in the browsing environment. The proposed system will help general web users and system administrators to maintain and control a secure browsing environment in the enterprise.

The study of physical or behavioral characteristics utilized for the identification of a human being is called biometric. Dorsal hand vein biometric traits have been used for biometric identification in present manuscript. First of all, Input dorsal hand vein image is preprocessed in proposed approach. The feature is extracted from preprocessed image using Orientation of Local Binary Pattern (OLBP) in binary format. Hamming distance is used for matching of features in proposed approach. Proposed approach has been tested on dataset of 600 vein images collected from 50 people.

The paper aims to propose a framework of information leakage warning system based on the principle of quantitative information flow. The quantification of information leakage has been widely used to decide the threshold of information leakage in program code but the purpose of the proposed framework is to use quantification based information leakage threshold to design practical information leakage warning system for real-time software. In the proposed framework, the software is considered as a collection of functions and each function is considered as register automata. Using the register automata working principles, the information leakage will be quantified during runtime of the software and when the software is in its pristine form. Based on the quantified amount of information leakage in both the cases, the framework warns the user about information leakage. Algorithmic steps of the proposed approach are also included in the paper. The proposed quantitative analysis based framework leads to flexible information security policy.

Purpose Situation awareness theory is a primary mean to take decisions and actions in a dynamically changing environment. Nowadays, to implement situation awareness, theories and models in organizational scenarios have become an important research challenge. The purpose of this paper is to investigate the relationship between the situation awareness theory and cybernetics. Further, the aim is to use this relationship to check the feasibility of situation awareness-based information security risk management (ISRM) implementation in the organizational scenario. Design/methodology/approach To investigate the relationship between situation awareness theory and cybernetics, Endsley’s situation awareness theory and Norbert Wiener’s cybernetics concepts and philosophy have been used in the present work. For a detailed study, concepts, techniques and philosophy of the cybernetics have been extracted from the thesis of Norbert Wiener titled “The human use of human beings” and “Cybernetics or control and communication in the animal and the machine”. Findings The present paper demonstrates that relationship can be successfully established between cybernetics and situation awareness theory. Further, this relationship can be used to solve organizational implementation issues related to situation awareness based systems. To demonstrate relationship and solutions of implementation issues, two case studies related to ISRM are also incorporated in the present case study. Originality/value The present work bridges two parallel and prominent theories of situation awareness and cybernetics. It also demonstrates that combination of both the theories can be used to feasibly implement situation awareness based systems in organizations.

In multithreaded programs, scheduler controls the execution of threads. As a result, the scheduler may arrange the execution sequence of threads in such a way that multithreaded programs may violate the non-interference confidentiality policy. Due to a violation of non-interference, multithreaded programs may leak security sensitive information. In the proposed work, Ant Colony Optimization (ACO) based intelligent scheduling policy has been proposed in the form of algorithms to schedule threads in multithreading environment in such a way that the execution sequence leads to minimal information leakage. In the present work, the proposed scheduler also deals with conflicting scheduling parameters and provides the algorithmic solution which can handle all conflicting entities of scheduling like throughput, delay, security-privacy and fairness. In this work, dynamic creation and deletion of threads are also handled during the scheduling. Although the focus of this work is on the scheduling of threads, the proposed policy can be used as a general purpose scheduling policy in many computing fields.

Purpose Nowadays, to design the information security mechanism for computing and communication systems, there are various approaches available like cryptographic approach, game-theoretic approach, quantitative–qualitative analysis-based approach, cognitive-behavioral approach, digital forensic-based approach and swarm computing-based approach. The contemporary research in these various fields is independent in nature. The purpose of this paper is to investigate the relationship between these various approaches to information security and cybernetics. Design/methodology/approach To investigate the relationship between information security mechanisms and cybernetics, Norbert Wiener’s concepts and philosophy of the cybernetics have been used in the present work. For a detailed study, concepts, techniques and philosophy of the cybernetics have been extracted from the books of Norbert Wiener titled “The human use of human beings” and “Cybernetics or control and communication in the animal and the machine”. Findings By revisiting the concepts of the cybernetics from the information security perspectives, it has been found that the aspects of information security and the aspects of cybernetics have great bonding. Originality/value The present paper demonstrates how bonding between cybernetics and information security can be used to solve some of the complex research challenges in information security area.

In last few decades, web browser has become one of the most used computer applications. The web browser is available on many devices such as desktops, laptops, palm devices and even in cars. According to recent research reports, the browser is targeted most by exploits in attacks on both home and corporate users. The default browser security configuration may leak user's sensitive information. It may also give remote code execution facility to attacker. In this paper, a framework to detect web browser security misconfiguration is proposed. The misconfiguration leads to data sharing to third party and insecure data transfer. The system scans browser configuration and determine deviation of configuration from secure settings. In addition, the system provides facility to achieve the level of security configuration with respect to recommended settings.

Purpose Any computing architecture cannot be designed with complete confidentiality. As a result, at any point, it may leak the information. So, it is important to decide leakage threshold in any computing architecture. To prevent leakage more than the predefined threshold, quantitative analysis is helpful. This paper aims to provide a method to quantify information leakage in service-oriented architecture (SOA)-based Web services. Design/methodology/approach To visualize the dynamic binding of SOA components, first, the orchestration of components is modeled. The modeling helps to information-theoretically quantify information leakage in SOA-based Web services. Then, the paper considers the non-interference policy in a global way to quantify information leakage. It considers not only variables which interfere with security sensitive content but also other architectural parameters to quantify leakage in Web services. To illustrate the attacker’s ability, a strong threat model has been proposed in the paper. Findings The paper finds that information leakage can be quantified in SOA-based Web services by considering parameters that interfere with security sensitive content and information theory. A hypothetical case study scenario of flight ticket booking Web services has been considered in the present paper in which leakage of 18.89 per cent information is calculated. Originality/value The paper shows that it is practically possible to quantify information leakage in SOA-based Web services. While modeling the SOA-based Web services, it will be of help to architects to identify parameters which may cause the leakage of secret contents.

Online Social Networks (OSNs) are the hottest trend in the internet, allowing people to socialize and share information among themselves. The social networking platform especially Facebook presents the problem of non-restrictive change in the privacy policy associated with an object and the risks affecting the privacy of other users. Research communities have identified and discussed the problems that arises when a user changes the privacy of a particular post previously posted under ‘public’ privacy settings into ‘only me’ settings in Facebook. Any post allows other users to comment on it when it is in public mode. Changing the privacy settings to ‘only me’, grants restricted access to the post where only the owner can access that post and its related comments, there by violating the privacy of other users who had commented on the said post. We propose a novel approach to tackle this problem. We introduce an additional option called ‘My Comments' through which a user can access his comments even after the post's owner changes the privacy of that post from ‘Public’ to ‘only me'. This feature will provide the owner of the comment unprecedented access to all his comments/ likes for any post allowing him the freedom to delete, edit existing comments.

Information security related training is extremely important nowadays for various organizations. But for the trainer, it is difficult to know the existing skill levels of trainees in information security area and their expectations from the training. As a result, to decide the time allocation for each level of training also becomes a difficult task for the trainer. To solve this challenge, present work proposes neuroevolution based algorithm. The algorithm can also be useful for online training or web service/mobile app based training. The trainer needs to execute the algorithm in pre-training time and based on the result he/she can adjust or modify training content and time allocation for each training level.

Tiny Encryption Algorithm (TEA) is one of the fastest Encryption Algorithms. It is a lightweight cryptographic algorithm with minimal source code. Due to its simple logic in key scheduling TEA has suffered from related key and equivalent key attacks. Therefore a modified key schedule is proposed for TEA. The new key schedule applies Boolean function based SBox to generate different round keys for TEA. The resultant Modified TEA achieves better security than original TEA. The execution time analysis of modified TEA is also presented.

Multiple Target Tracking is an essential requirement for modern air surveillance system employing with multiple sensors to interpret the environment. The fundamental problem in a multiple target tracking system is that of data association - with the goal of choosing most probable association between a particular observation and target to be tracked. This paper presents an Optimized Multi-Sensor Multi-Target Tracking algorithm (OMSMTT) that solves measurement to track association conflicts in sensor data reports and capable of initiating and terminating new tracks. The proposed solution enhances the Multiple Hypotheses Tracking (MHT) algorithm with multidimensional assignment approach by modified scoring procedure which improves performance of the tracker. The work exploits a generalized assignment problem structure; formulate the new framework which treats measurement to track assignment for each target as a random variable and transform it to the particle filter for non maneuvering multi-target models. The algorithm is tested with non maneuvering targets with sparse scenarios in presence of clutter against traditional Multiple Hypothesis Tracker (MHT) under extreme conditions such as track swap and coalescences and analyzes it using different performance metrics.

Background: Nowadays, service-oriented architectures and cloud-based infrastructures are widely used in manufacturing industries and IT organizations. These architectures and infrastructures are based on shared system resources. In some organizations, system resources like a printer, photocopy machines, and scanners are also shared among the members of the organization. The purpose of the proposed work is to model various types of shared system resources, shared system resources based architecture/infrastructure and analyze the model to identify the possible security risk associated with shared system resources and shared system resources based architecture/infrastructure. Design Approach: To model shared system resources and shared system resources based architecture/Infrastructure, Petri net and its variations are used. For security analysis of the Petri net based model of the shared system resource, Petri net algebra based concepts are applied. Results: The present paper successfully demonstrates that the proposed Petri net based modeling approach can be used for quantitative and qualitative security analysis of shared system resources and shared system resources based architecture/infrastructure. For quantitative analysis of security risk associated with shared system resources, information theoretic concepts are used. To demonstrate the effectiveness of the proposed method, case studies are also incorporated in the present paper. The proposed approach can take various security risk factors like timing analysis attack, information leakage due to confidentiality policy violation and power analysis attack into the consideration while analyzing the security of shared system resources in the industrial environment.