Search

Security for web applications is an ongoing dilemma. Hackers and bots are getting more and more innovative in bypassing the various defensive tools implemented to enforce security. e-Commerce applications, such as those used for transaction processing, could be placed in a position of not providing a fair chance to all consumers because bots can interact more quickly. This is especially true when a commerce site offers popular inventory items where many traders are competing to get an item that has a limited supply. The e-Commerce site's security is compromised when some traders utilize pre-formatted scripts or spiders to place orders, thus giving them an unfair advantage. The problem is: how to eliminate the interaction of scripts and spiders in a given web application flow while requiring no additional actions taken by a human user. Our paper introduces an innovative multi-layer approach to honeypots where cashing or bypassing the honeypot is technically impractical. [ABSTRACT FROM AUTHOR]

Steganography is the direction of information security, which allows you to organize secure data exchange channel by hiding the existence of secret messages. Recently, there are many methods of computer steganography, and their systematization remained relevant scientific problem. In the paper the systematization of modern computer steganography methods was carried out. The general possible places to hide data in computer systems and networks were defined. The general description of data hiding methods in multimedia (digital) objects was included where attention was directed to methods of hiding in images because this is most popular object of steganographic research. Data hiding in polygraphy and methods based on pseudo holography were referred to computer steganography. [ABSTRACT FROM AUTHOR]

Determining of the most concepts is focused on specific sectors or industries as a result of the international legal base modernization. Analysis of scientific sources showed the lack of the works devoted to the base terminology research. This makes not clear the concepts of information security incident and cyber incident. As a result, methods and systems for responding to information security incidents (cyber incidents) are complicated and low efficient. In view of this, multicriteria analysis of concept definitions «incident» in international and industry standards, scientific publications, dictionaries, reference books and online resources were carried out. After the analysis a common set of basic features of the incident concept was identified and the generalized definitions of information security incident & cyber incident were proposed. [ABSTRACT FROM AUTHOR]

We present the results of the first long-term user study of site-based login mechanisms which force and train users to login safely. We found that interactive site-identifying images received 70% detection rates, which is significantly better than the results received by the typical login ceremony and with passive defense indicators [in: CHI'06: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, ACM, New York, 2006, pp. 601-610; Computers & Security 28(1,2) (2009), 63-71; in: SP'07: Proceedings of the 2007 IEEE Symposium on Security and Privacy, IEEE Computer Society, Washington, 2007, pp. 51-65]. We also found that combining login bookmarks with interactive images and 'non-working' buttons/links achieved the best detection rates (82%) and overall resistance rates (93%).We also present WAPP (Web Application Phishing-Protection), an effective server-side solution which combines the login bookmark and the interactive custom image indicators. WAPP provides two-factor and two-sided authentication. [ABSTRACT FROM AUTHOR]

Recently, the leak of domestic core technology of major business in Korea and the subsequent damage, has been increasing every year. Financial losses due to this leak are estimated to be about 220 trillion, which is equivalent to the gross budget of Korea Besides. Currently, the paradigm of industrial security has been changed from simple installation of security equipment to efficient management and control market. Leakage of internal material is able to be prevented, blocked and tracking afterward innovatively through enterprise risk management and security control by fusion of physical security system (entrance control system, vision security system etc.) and IT integrated security control system. It can be possible to setup systematical converging security control process in short term by achieving an effect to running expert organization without additional investment for current physical security and IT security personnel, and it is needed to firmly setup the acquisition and integrated control of IT security and physical security, connected tracking control when security issue is happened, definition for terms of information leakage and security violation and real-time observation, rapid determination and reaction/corrective action for trial of security violation and information leakage, phased and systematic security policy by individual technology. The majority of the leaks are caused by former and current staff members, cooperated businesses, scientists and investment companies. This shows that the sources of the leaks are internal personnel. In this manner, we can infer that the management and plan of personnel security has not implemented sound practices to prevent technology leak by people. Therefore, this thesis suggests classifying methods of technology leak through clustering, one of the data mining methods about the information of internal personnel to prevent core technology leak from businesses. [ABSTRACT FROM AUTHOR]

Based on the ring signature technology, the multi-receiver ID-based anonymous signcryption (MIBAS) is proposed, and its goal is to protect the privacy of the sender or so-called signer. In an MIBAS scheme, every receiver can verify whether the sender is a member of a trusted group and thus ensure the reliability of the message source, but he could not get the real sender. However, MIBAS paid no attention to privacy of the receivers and has not taken the privacy of the receivers into account during its design. Our analyses show that there widely exist the receiver privacy exposure and decryption unfairness problems in the existing multi-receiver ID-based signcryption schemes. Motivated by these concerns, a new multi-receiver ID-based anonymous signcryption (nMIBAS) is proposed to protect the identity of the receivers. The nMIBAS scheme can not only solve the problem that the existing schemes cannot protect the privacy of receivers, but also meet the fairness of decryption to prevent the possible cheating behavior of the sender effectively. Analysis shows that this scheme is a secure and effective signcryption scheme. [ABSTRACT FROM AUTHOR]

As organizations increase their reliance on, possibly distributed, information systems for daily business, they become more vulnerable to security breaches even as they gain productivity and efficiency advantages. Though a number of techniques, such as encryption and electronic signatures, are currently available to protect data when transmitted across sites, a truly comprehensive approach for data protection must also include mechanisms for enforcing access control policies based on data contents, subject qualifications and characteristics, and other relevant contextual information, such as time. It is well understood today that the semantics of data must be taken into account in order to specify effective access control policies. Also, techniques for data integrity and availability specifically tailored to database systems must be adopted. In this respect, over the years the database security community has developed a number of different techniques and approaches to assure data confidentiality, integrity, and availability. In this paper, we first survey the most relevant concepts underlying the notion of database security and summarize the most well-known techniques. [ABSTRACT FROM AUTHOR]

With the evolution and fusion of wireless sensor network and embedded camera technologies, distributed smart camera networks have emerged as a new class of systems for wide-area surveillance applications. Wireless networks, however, introduce a number of constraints to the system that need to be considered, notably the communication bandwidth constraints. Existing approaches for target tracking using a camera network typically utilize target handover mechanisms between cameras, or combine results from 2D trackers in each camera into 3D target estimation. Such approaches suffer from scale selection, target rotation, and occlusion, drawbacks typically associated with 2D tracking. In this paper, we present an approach for tracking multiple targets directly in 3D space using a network of smart cameras. The approach employs multi-view histograms to characterize targets in 3D space using color and texture as the visual features. The visual features from each camera along with the target models are used in a probabilistic tracker to estimate the target state. We introduce four variations of our base tracker that incur different computational and communication costs on each node and result in different tracking accuracy. We demonstrate the effectiveness of our proposed trackers by comparing their performance to a 3D tracker that fuses the results of independent 2D trackers. We also present performance analysis of the base tracker along Quality-of-Service (QoS) and Quality-of-Information (QoI) metrics, and study QoS vs. QoI trade-offs between the proposed tracker variations. Finally, we demonstrate our tracker in a real-life scenario using a camera network deployed in a building. [ABSTRACT FROM AUTHOR]

Improve the safety of cloud computing is important for widely using it in real application. For solving this problem, a security mechanism for cloud computing platform based on virtualization is proposed in this paper. The system structure is introduced in detail, which is mainly composed of two parts, behavior gathering module and behavior analyzing module. Then, the functional characteristics of all entities are described, and the communication mechanism of the system is also represented. [ABSTRACT FROM AUTHOR]

Purpose – The purpose of this paper is to introduce VoxGrid, a mobile voice verification system intended for improving the security of the username-password authentication scheme. Design/methodology/approach – The system incorporates text-dependant speaker verification via mobile devices that provides for a three-factor authentication scheme for granting authorised access to certain websites or applications. The same speech recognition engine used by Google Voice Search is utilised to provide voice-to-text feature. All verification tasks are performed on a centralised server to minimise computing requirements on mobile platforms where feature extractions is executed using Mel Frequency Cepstral Coefficients. The resulting features are transmitted to the server instead of raw voice data to reduce network load. Actual voice verification takes place in the central server using Vector Quantisation. Findings – The initial results have indicated that VoxGrid is capable of providing an additional level of security on user authentications at a low cost and without using extra security tokens other than one's voice with a good enough performance given the limited resources available during testing. Originality/value – Past speaker verification experiments have been conducted but we see that this is the first time it is done on mobile devices with a client-server architecture using K-Means Clustering and Vector Quantisation. Future improvements on performance and testing could result in a more secure mobile computing environment. [ABSTRACT FROM AUTHOR]

Purpose – The SOUL System aims to provide a low-cost secure online two-factor authentication system that involves both a password and a security token in the form of an ordinary electronic container. Its main goal is to design and build a system that can easily be integrated to existing websites to make the login and registration processes more secure. Design/methodology/approach – The three main parts of the system are the website, the ordinary hardware device, and trusted third party. The website must first be integrated with the web API provided and then registered to the trusted third party website to allow two-factor authentication. It must be registered to the trusted third party so that it can be used to register and login to SOUL System integrated websites. Findings – The design and implementation of the proposed two-factor authentication system makes use of the hybrid cryptosystem, one-time passwords, hash functions, trusted third parties, steganographic techniques, signed java applets and cross-language cryptographic libraries. It protects users from well known attacks such as brute-force attacks, collision attacks, dictionary attacks, keylogger attacks, man-in-the-middle attacks, and even replay attacks. Currently, the system can be integrated to websites built in PHP, Python, and Java. Originality/value – The SOUL System is the first two-factor authentication system that uses both cryptography and steganography to provide secure online authentication with an ordinary USB flash drive. It is designed to work in major operating systems such as Windows, Mac OS X, and Linux with very minimal installation. [ABSTRACT FROM AUTHOR]

The US billion dollars investments in cyber security are creating a securitisation of cyberspace. What has happened meanwhile in Europe? The argument is threefold. First, cyber threats were raised to the national threat level in Germany (2006), France (2008) and the UK (2008), but the justifications put forward for such an upgrade did not hold, as well as invested resources at that point in time. Second, cyber security strategy followed up this upgrade and designed a framework to tackle the threat that was found coherent with the assessment of the respective national security strategies. Third, cyber insecurity stemmed from criminals operating in cyberspace. Therefore, deterring criminals should have been at the core of tackling cyber insecurity but the defence strategies of France, Germany and the UK were instead focused on mitigating the effects of cyber attacks. [ABSTRACT FROM PUBLISHER]

Several studies on youth and social networks have generally revealed extensive usage of these Internet services, widespread access from almost any location and the special importance that the youth attach to these services in building their social relations. This article presents part of the analyses and results from a research questionnaire on «Scenarios, digital technologies and youth in Andalusia», administered to a population of 1,487 youth between the ages of 13 and 19. The discussion on young Andalusians and social networks revolves around the structure and configuration of their profiles, intended uses and the privacy and security involved. The results reveal a population with nearly unlimited access to social networks and with very little adult monitoring; moreover, those connecting are younger than the legal minimum age defined by the Internet services themselves. The motivations of Andalusian youth for using social networks fall into three areas. The first two, social and psychological/affective motivations, are also commonly found in other studies; the third refers to the need to use social networks in matters concerning everyday life. This paper suggests certain new aspects in its conclusions in order to explain the nature and meaning of the practices of Andalusian youth in social networks. [ABSTRACT FROM AUTHOR]

Purpose – The purpose of this paper is to highlight the relation of psychosocial risks to information security (IS). Although psychosocial risks at the workplace have been extensively researched from a managerial point of view, their effect on IS has not been formally studied to the extent required by the gravity of the topic. Design/methodology/approach – Based on existing research on psychosocial risks, their potential effects on IS are examined. Findings – It is shown that as psychosocial risks affect people at the workplace, they diminish their ability to defend IS. Research limitations/implications – Psychosocial risks are identified as a factor in IS breakdown. Future research should be directed towards assessing the significance of the effects of various psychosocial risks on IS, creating an assessment methodology for the resulting IS posture of the organisation and devising mitigation methodologies. Practical implications – The proposed approach will provide a significant part of the answer to the question of why IS fails when all prescribed measures and controls are in place and active. More effective controls for psychosocial risks at the workplace can be created as the incentive of upholding IS will be added to the equation of their mitigation. Social implications – The organisational environment in which human beings are called upon to function in a secure manner will be redefined, along with what constitutes a "reasonable request" from human operators in the context of IS. Originality/value – Bringing together psychosocial risks and IS in research will provide a better understanding of the shortcomings of human nature with respect to IS. Organisations and employees will benefit from the resulting psychosocial risk mitigation. [ABSTRACT FROM AUTHOR]

This study aims to understand the web risk information seeking intention of end users. Applying the risk information seeking and processing model (RISP), this paper examines end users' web risk information seeking intention. Hypotheses are proposed concerning the intention to seek information about one emerging web risk: cross site scripting. Data were collected from 201 college students in the southern United States. The results suggest that information insufficiency, informational subjective norm, and affective response are positively related to web risk information seeking intention. In addition, informational subjective norm and negative affect are positively related to information insufficiency. Negative affect is determined by perceived vulnerability and perceived severity of the web risk. The study proves RISP to be an adequate model to use in the web risk context and provides an enriched understanding about users' intention to seek web risk information. [ABSTRACT FROM AUTHOR]

It was well known from Shannon's days that characteristics of the physical channel like attenuation, fading and noise can impair reliable communication. But it was more recently that the beneficial side effects of channel characteristics in ensuring secret communication started getting attention. Studies have been made to quantify the amount of secrecy that can be reaped by combining channel coding with security protocols. The Wiretap channel proposed by Wyner is arguably one of the oldest models of physical layer security protocols. In this paper, we present a brief tutorial introduction to the Wiretap channel, followed by an application of the physical layer model to a class of Key Distribution protocols. We present results from an implementation of key distribution protocols using Software Defined Radio tools along with physical RF hardware peripherals. We believe this approach is much more tangible and informative than computer based simulation studies. [ABSTRACT FROM AUTHOR]

As Internet and Web technologies have been used in different fields by various organizations, cyber security has become a significant public concern for the society as a whole. There is a broad consensus on the need for broader and better training and education of the current and future workforce to be able to effectively deal with present, emergent and future cyber security challenges. However, cyber-security education tends to be constrained to computer and information science degree programs. Further, the courses within these programs tend to be offered via conventional instructional mechanisms that entail limited hands-on learning experiences due to the difficulty, cost, and potential risks of setting up real worm like hands-on security training environments, which are often network-based. Considering cyber security education is a necessary need across all disciplines and majors, we have been undertaking a research project at a public college to (a) construct a model to study the influence of knowledge from lectures and hands-on experience on security behavior using protection motivation theory (b) develop a series of laboratory based Information Security education modules as easy to tailor and scalable pedagogic tools for helping undergraduate students to comprehend information security at different levels, and (c) test the impact of these modules on students' post-training personal cyber security behavior. Our aim is to identify if indeed students do apply what they learn to confidently and intelligently address personal cyber security challenges, after they have completed these course modules. In this paper, we report (a) our theoretical model (b) the design of security pedagogy modules and, (c) the preliminary findings upon testing and surveying students 'post-training knowledge and post-training behavior concerning the security topics covered in the training modules. [ABSTRACT FROM AUTHOR]

ABSTRACT Recently, Tseng et al. proposed a novel key agreement protocol based on chaotic maps. They claimed that their protocol achieved the session key agreement between server and users with user's anonymity and security. Although Niu and Wang proposed a new improvement, the presented scheme involved an additional participant, the trusted party, in such a way that the system cost raised a lot. To inherit the superiority of Tseng et al. but remove the security weaknesses, it is worthwhile to point out the kernel of drawback in the scheme of Tseng et al. and, further, propose a security-enhanced scheme by overcoming the drawback with slight modifications. Copyright © 2012 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Web threat is any threat that uses the internet to facilitate identity theft, fraud, espionage and intelligence gathering. Web-based vulnerabilities now outnumber traditional computer security concerns. Such threats use multiple types of malware and fraud, all of which utilize HTTP or HTTPS protocols, but may also employ other protocols and components, such as links in email or IM, or malware attachments or on servers that access the Web. In Nigeria this threat is usually in the form spam and phishing. This paper therefore explained some of the methods cybercriminals use to perpetrate web threat and measures that should be taken by relevant authority to minimize the impact posed by such threat to e-business. [ABSTRACT FROM AUTHOR]

Given the growing trend of electronic networks of practice and the growing propensity of individuals to rely on the Internet for problem solving, we examine whether programmers in a hypothetical situation would be likely to disclose confidential information through an online forum in attempt to solve a programming problem. We hypothesize and find in a survey of 187 programmers that online forum commitment and trust lead to greater online forum participation, which in turn predicts a higher likelihood of confidential information disclosure. We also find that programmers with greater awareness of security policies exhibit a lower likelihood of deciding to risk disclosing confidential information. The study contributes to extant literature by raising and exploring the potentially negative, dark side of knowledge sharing through electronic networks of practice. [ABSTRACT FROM AUTHOR]

We present novel perfect secrecy systems that provide immunity to spoofing attacks under equiprobable source probability distributions. On the theoretical side, relying on an existence result for t-designs by Teirlinck, our construction method constructively generates systems that can reach an arbitrary high level of security. On the practical side, we obtain, via cyclic difference families, very efficient constructions of new optimal systems that are onefold secure against spoofing. Moreover, we construct, by means of t-designs for large values of t, the first near-optimal systems that are fivefold and sixfold secure as well as further systems with a feasible number of keys that are sevenfold secure against spoofing. We apply our results furthermore to a recently extended authentication model, where the opponent has access to a verification oracle. We obtain this way novel perfect secrecy systems with immunity to spoofing in the verification oracle model. [ABSTRACT FROM AUTHOR]

This paper investigates insider threat in relational database systems. It discusses the problem of inferring unauthorized information by insiders and proposes methods to prevent such threats. The paper defines various types of dependencies as well as constraints on dependencies that may be used by insiders to infer unauthorized information. It introduces the constraint and dependency graph (CDG) that represents dependencies and constraints. In addition, CDG shows the paths that insiders can follow to acquire unauthorized knowledge. Moreover, the paper presents the knowledge graph (KG) that demonstrates the knowledgebase of an insider and the amount of information that the insider has about data items. To predict and prevent insider threat, the paper defines and uses the threat prediction graph (TPG). A TPG shows the threat prediction value (TPV) of each data item in insiders' KG, where TPV is used to raise an alert when an insider threat occurs. The paper provides solutions to prevent insider threat without limiting the availability of data items. Algorithms, theorems, proofs and experiments are provided to show the soundness, the completeness and the effectiveness of the proposed approaches. [ABSTRACT FROM AUTHOR]

Extending the narrow scope of building management systems to form the ‘intelligent building’ has led to the widespread use of proprietary ‘enterprise’ software platforms and networks in both monitoring and control. The PC user is only too familiar with the vulnerability of networked computers to malicious software. But it is only recently that attention has been paid to the possibility of virus damage to process controllers. The hazard for ‘building management systems’ functionality is real but the risk is difficult to assess. Pressures on system procurement and upgrades aimed at improving functionality bring with them increased exposure to the probability of a successful attack. Most published security protocols may engender a false sense of security. The key defence is to ensure a ‘fall-back’, ‘black start’, ‘dumb capability’ within the intelligent building. [ABSTRACT FROM AUTHOR]

Copyright of Military Engineer / Hadmérnök is the property of National University of Public Service and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

By considering the varying latency period of computer virus, we propose a novel model for computer virus propagation in network. Under this model, we give the threshold value determining whether or not the virus finally dies out, and study the local stability of the virus-free and virus equilibrium. It is found that the model may undergo a Hopf bifurcation. Next, we use different methods to prove the global asymptotic stability of the equilibria: the virus-free equilibrium by using the direct Lyapunov method and virus equilibrium by using a geometric approach. Finally, some numerical examples are given to support our conclusions. [ABSTRACT FROM AUTHOR]

Since the publication of Hwang-Li's password-based remote user authentication scheme with smart cards, a number of password-based authentication schemes with smart cards have been proposed to meet a variety of desirable security and performance requirements. In this paper, security flaws in three password-based remote user authentication schemes with smart cards are pointed out. These results demonstrate that no more password-based authentication schemes with smart cards should be constructed with such ad-hoc methods, i.e., the formal design methodology with provable security approach should be employed in future design. [ABSTRACT FROM PUBLISHER]

Abstract: Researchers in telesurgical robotics and security collaborated to develop the Secure ITP, a security enhancement to the Interoperable Telesurgery Protocol (ITP). The ITP defines the structure for communication between telesurgery robots and controllers and has been adopted and tested by fourteen research groups in telesurgical robotics. The Secure ITP uses open source software tools and follows guidelines in Federal Information Processing Standards (FIPS) documents published by the National Institute of Standards and Technology (NIST) to create asecurity enhancement prototype for demonstration purposes and tofacilitate the development of new security technologies which addressthe stringent requirements of telesurgery. [Copyright &y& Elsevier]

Abstract: Authentication header protocol was introduced to neighbor discovery protocol to ensure its security. A security neighbor discovery protocol model based authentication header was proposed. In this model, multicast Internet key exchange and management protocol was designed, star structure key management algorithm was presented, and IP addresses and link-layer address was bound in the AH authentication data. Compared with the current security neighbor discovery algorithm, experiments results show that the proposed security model can effectively ensure security of neighbors, and defense to forge IP address, and improve the security of next generation Internet. [Copyright &y& Elsevier]

At present, many countries allow citizens or entities to interact with the government outside the telematic environment through a legal representative who is granted powers of representation. However, if the interaction takes place through the Internet, only primitive mechanisms of representation are available, and these are mainly based on non-dynamic offline processes that do not enable quick and easy identity delegation. This paper proposes a system of dynamic delegation of identity between two generic entities that can solve the problem of delegated access to the telematic services provided by public authorities. The solution herein is based on the generation of a delegation token created from a proxy certificate that allows the delegating entity to delegate identity to another on the basis of a subset of its attributes as delegator, while also establishing in the delegation token itself restrictions on the services accessible to the delegated entity and the validity period of delegation. Further, the paper presents the mechanisms needed to either revoke a delegation token or to check whether a delegation token has been revoked. Implications for theory and practice and suggestions for future research are discussed. [ABSTRACT FROM AUTHOR]

The global information rich society is increasingly dependent on mobile phone technology for daily activities. A substantial secondary market in mobile phones has developed as a result of a relatively short life-cycle and recent regulatory measures on electronics recycling. These developments are, however, a cause for concern regarding privacy, since it is unclear how much information is retained on a device when it is re-sold. The crucial question is: what, despite your best efforts, does your mobile phone reveal about you?. This research investigates the extent to which personal information continues to reside on mobile phones even when users have attempted to remove the information; hence, passing the information into the secondary market. A total of 49 re-sold mobile devices were acquired from two secondary markets: a local pawn shop and an online auction site. These devices were examined using three industry standard mobile forensic toolkits. Data were extracted from the devices via both physical and logical acquisitions and the resulting information artifacts categorized by type and sensitivity. All mobile devices examined yielded some user information and in total 11,135 artifacts were recovered. The findings confirm that substantial personal information is retained on a typical mobile device when it is re-sold. The results highlight several areas of potential future work necessary to ensure the confidentially of personal data stored on mobile devices. [ABSTRACT FROM AUTHOR]

Designated verifier signature (DVS) allows a signer to convince a designated verifier that a signature is generated by the signer without letting the verifier transfer the conviction to others, while the public can still tell that the signature must be generated by one of them. Strong DVS (SDVS) strengthens the latter part by restricting the public from telling whether the signature is generated by one of them or by someone else. In this paper, we propose two new SDVS schemes. Compared with existing SDVS schemes, the first new scheme has almost the same signature size and meanwhile, is proven secure in the standard model, while the existing ones are secure in the random oracle model. It has tight security reduction to the DDH assumption and the security of the underlying pseudorandom functions. Our second new scheme is the first SDVS supporting non-delegatability, the notion of which was introduced by Lipmaa, Wang and Bao in the context of DVS in ICALP 2005. The scheme is efficient and is provably secure in the random oracle model based on the discrete logarithm assumption and Gap Diffie-Hellman assumption. [ABSTRACT FROM AUTHOR]

Given that phishing is an ever-increasing problem, a better authentication system is required. We propose a system that uses a graphical password deployed from a Trojan and virus-resistant embedded device. The graphical password utilizes a personal image to construct an image hash, which is provided as input into a cryptosystem that returns a password. The graphical password requires the user to select a small number of points on the image. The embedded device will then stretch these points into a long alphanumeric password. With one graphical password, the user can generate many passwords from their unique embedded device. The image hash algorithm employed by the device is demonstrated to produce random and unique 256-bit message digests and was found to be responsive to subtle changes in the underlying image. Furthermore, the device was found to generate passwords with entropy significantly larger than that of users passwords currently employed today. [ABSTRACT FROM AUTHOR]

Computer systems today can be seen as a problem of pattern classification, the system must deal with some intrinsic characteristics that make it very difficult to detect intrusions directly using classical pattern recognition methods. For example, normal and anomalous states are distinguished using features that are multi-dimensional, and there is extreme asymmetry and high overlap in the amount of data available for these two systems of states. Furthermore, the patterns involved cannot be recognized by linear methods without kernel maps. The natural human immune system faces the same difficulties, but successfully protects the body against a vast variety of foreign pathogens. It is a self-adaptive and self-learning classifier that can recognize and classify threats by learning, long-term memory, and association. We have adapted the mechanisms of the human immune system to construct an intrusion detection system to protect computer networks. [ABSTRACT FROM AUTHOR]

Steganography is the art and science of hiding important information by embedding message within other file. A new Least Significant Bit (LSB) steganography technique is presented in this work by treating the secret message based on its words content instead of its characters content. By using a specific small words dictionary by the sender and the receiver of the secret message, and representing each word in the secret message with an index in the words dictionary. Then embed these words indices, of the secret message, in the LSB of the pixels in the stego-image. The experimental results shown that the Word Based LSB technique will add more security to the secret message, reduces the distortion that will occur in the stego-image, increase the capability to hide very long secret message in a small stego-image, and minimize the time that is needed to hide and extract the secret message. [ABSTRACT FROM AUTHOR]

Secure message transmission can be solved perfectly assuming that the adversary controls less than one half of the paths connecting two nodes in a network while the rest of the paths are physically secured. Nevertheless, in many settings such assumption can be too strong to be realistic. While it may be reasonable to restrict the adversary full corruption, the adversary may have eavesdropping capabilities that extend over the whole network (beyond the corrupted nodes). In this case, we cannot run away of employing encryption techniques and hence, in addition to the fact that the security turns to be computational, adaptive adversaries come to play. In this paper, we present a new Adaptively Secure Message Transmission (ASMT) that is based on any trapdoor function in the non-erasure model to allow any pair of nodes in a network to communicate in an adaptively secure manner assuming that the adversary observes (eavesdrops) the communications on all paths but actively corrupts a fraction of these paths. Our constructions are built using any available trapdoor function that is one-way secure. [ABSTRACT FROM AUTHOR]

Internet and networks applications are growing very fast, so the needs to protect such applications are increased. Cryptography refers to the science and art of transforming messages to make them secure and immune to attacks. Cryptography encryption algorithms play a main role in information security systems. Those algorithms consume a significant amount of computing resources. National Institute of Standards and Technology (NIST) initiated a process to select a symmetric-key encryption algorithm to be used to protect sensitive information & in many scenarios, RC6 is the fastest AES finalist. This paper focuses on the analysis of RC6 symmetric encryption algorithm as AES considering certain parameters such as computation time, throughput & power consumption. [ABSTRACT FROM AUTHOR]

String extraction and matching techniques have been widely used in generating signatures for worm detection, but how to generate effective worm signatures in an adversarial environment still remains a challenging problem. For example, attackers can freely manipulate byte distributions within the attack payloads and thus inject well-crafted noisy packets to contaminate the suspicious flow pool. To address these attacks, we propose SAS, a novel S emantics A ware S tatistical algorithm for automatic signature generation. When SAS processes packets in a suspicious flow pool, it uses data flow analysis techniques to remove non-critical bytes. We then apply a hidden Markov model (HMM) to the refined data to generate state-transition-graph-based signatures. To our best knowledge, this is the first work combining semantic analysis with statistical analysis to automatically generate worm signatures. Our experiments show that the proposed technique can accurately detect worms with concise signatures. Moreover, our results indicate that SAS is more robust to the byte distribution changes and noise injection attacks compared to Polygraph and Hamsa. [ABSTRACT FROM AUTHOR]

Enforcing security often requires the two legitimate parties of a communication to determine if they share a secret, without disclosing information (e.g., the shared secret itself, or just the existence of such a secret) to third parties. In this paper, we propose CASSANDRA, a toolbox composed of three probabilistic protocols that allows two parties, each one having a subset of elements drawn by a pre-determined set, to compute information about the intersection of such two sets. In particular, C-void decides whether the two sets are disjoint; C-size allows to compute how many elements the intersection is composed of; and, C-set returns the identity of the elements of the intersection (if any). These protocols differ, other than in functionality, also in the degree of assurance they can provide and the degree of interactions required by the two parties. The communication cost also differs, but in any case, it is below the cost of competing solution representing the state of the art. These protocols also share some common features: that is, they are completely tunable and specifically suited for devices having constraints on energy, communication, storage, and bandwidth. Examples of these devices are portable devices (e.g., phones) handling satellite communications, or nodes of wireless sensor networks. Thorough analysis and extensive simulations support our findings. [ABSTRACT FROM AUTHOR]

We propose a framework that uses (external) environment information to enhance computer security. The benefit of our framework is that the environment information is collected by sensors that are outside the control of a host and communicate to an external monitor via an out-of-band channel (w.r.t. the host), thus it cannot be compromised by malware on a host system. The information gathered still remains intact even if malware uses rootkit techniques to hide its activities. Our framework can be applied for a number of security applications: (1) intrusion detection; (2) rate monitoring/control of external resources; and (3) access control. We show that that the framework is useful even with coarse-grained and simple information. We present some experimental prototypes that employ the framework to detect/control email spam, detect/control DDoS zombie attacks and detect misuse of compute resources. Experimental evaluation shows that the framework is effecting in detecting or limiting the activities of such malware. The growing popularity of multimodal sensors and physical security information management systems suggests that such environmental sensors will become common making our framework cost effective and feasible in the near future. [ABSTRACT FROM AUTHOR]

This paper presents results of empirical study of passwords really used on internet. These passwords were obtained during two data acquisitions in three years period. In this paper a method for the evaluation of password security against a dictionary attack and a brute force attack is suggested and used for security evaluation of these passwords. The method is based on a mathematical model and a simulation of dictionary attack and a brute force attack. In the paper trends of password selecting are identified and expected progress is outlined. Simultaneously truly used passwords are investigated by statistic methods. [ABSTRACT FROM AUTHOR]

We present a computational analysis of basic Kerberos with and without its public-key extension PKINIT in which we consider authentication and key secrecy properties. Our proofs rely on the Dolev-Yao style model of Backes, Pfitzmann, and Waidner, which allows for mapping results obtained symbolically within this model to cryptographically sound proofs if certain assumptions are met. This work was the first verification at the computational level of such a complex fragment of an industrial protocol. By considering a recently fixed version of PKINIT, we extend symbolic correctness results we previously attained in the Dolev-Yao model to cryptographically sound results in the computational model. [ABSTRACT FROM AUTHOR]

We develop a new notion of security against timing attacks where the attacker is able to simultaneously observe the execution time of a program and the probability of the values of low variables. We then propose an algorithm which computes an estimate of the security of a program with respect to this notion in terms of timing leakage and show how to use this estimate for cost optimisation. [ABSTRACT FROM AUTHOR]

The article discusses a study on the computer science (CS) research particularly computer security research and its relationship with committees reviewing human subjects research. It aims to draw attention to the possible human subjects research ethics principles and to explore how changing technologies can call for reconceptualizing human subjects research ethics review. It notes that research ethics board (REB) should seek out opportunities to work collaboratively with CS or security research and suggests for REBs to consider new but analogous models.

The article presents research on risk management related to computer network security in management information systems. A queuing model is presented to quantify the downtown loss faced by a network in a security attack and compare it to the costs of investment in computer security technologies, diversification of computer software to limit the risk of coordinated failure and investment in information technology to repair failures. Situations under which the strategy of diversification of computer software are financially advantageous are discussed.

Market research surveys report that 75% of hacks occur at the application layer. Of the multiple vulnerabilities that exist in Web application software, proper authentication of the client and the server to each other is fundamental to the security of the system. In the current scenario, we manage this with the adoption of password-based client authentication and PKI-based server authentication. There exist unresolved vulnerabilities in this system due to the misuse of the client's passwords (impersonation) by those managing the servers. The clients' trust of the server based on the certificates issued by an increasing number of certification authorities is questionable in terms of validity and freshness. For proper authentication in Web applications, we need to verify two conditions: 1) the binding of the identity of the entity with the publicly known name or key and 2) the entity does possess the corresponding private key for the identified public key. In this paper, we use the elliptic curve discrete log problem-based version of classical zero knowledge protocol for proving number 2 and modifications of the existing schemes for proving number 1. We have done a prototype implementation of the solution and security analysis required to satisfy the security objectives. [ABSTRACT FROM AUTHOR]

integrated circuits (ICs) continue to have an overwhelming presence in our digital information-dominated world, having trust in their manufacture and distribution mechanisms is crucial. However, with ever-shrinking transistor technologies, the cost of new fabrication facilities is becoming prohibitive, pushing industry to make greater use of potentially less reliable foreign sources for their IC supply. The 2008 Computer Security Awareness Week (CSAW) Embedded Systems Challenge at the Polytechnic Institute of NYU highlighted some of the vulnerabilities of the IC supply chain in the form of a hardware hacking challenge. This paper explores the design and implementation of our winning entry. [ABSTRACT FROM AUTHOR]

The majority of current security architectures for grid systems use public key infrastructure (PKI) to authenticate identities of grid members and to secure resource allocation to these members. Identity-based cryptography (IBC) has some attractive properties that seem to align well with the demands of grid computing. This paper presents a comprehensive investigation into the use of identity-based techniques to provide an alternative grid security architecture. We propose a customised identity-based key agreement protocol, which fits nicely with the grid security infrastructure (GSI). We also present a delegation protocol, which is simpler and more efficient than existing delegation methods. Our study shows that properties of IBC can be exploited to provide grid security services in a more natural and clean way than more conventional public key cryptosystems, such as RSA. [ABSTRACT FROM AUTHOR]

The personal computer, and cyber technology in general, opens the doors to the world. Unless an organization can cultivate the flexibility to adapt its processes to the demands of this new technology, it could diminish its capability to execute effective protective and responsive countermeasures against malevolent or unwanted cyber intrusion. In this paper, we define and use the term cyberinfrastructure system to connote a generalized complex, large-scale cyberinfrastructure network that includes hardware, software, organizational policies and procedures, and that is connected to the Internet (e.g., by means of telephone lines, wireless devices, and high-speed technology). Following a malevolent cyber attack, the original cyberinfrastructure security model could have been (unbeknownst to the system's operators) perturbed and changed, not by its designers, but by adversaries. In other words, the road-map design of the cyberinfrastructure system, which connotes the policies, procedures, methods, connections, and other human and organizational activities that define the functionality of the cyberinfrastructure system, could have been changed following a malevolent cyber attack. Resilience of a cyberinfrastructure system, which is central to its security, is defined as the ability of the system to withstand a major disruption within acceptable degradation parameters and to recover within an acceptable composite cost and time. The central role of systems integration in cyber security is highlighted because it not only connotes the integration of components, but also involves an understanding of the functionality that emerges from that integration. Systems modeling is indispensable in developing awareness when a cyberinfrastructure is intruded and is being violated. Cyberinfrastructure security is essentially multidimensional and of multi-scale compositions—from molecular to macro dimensions—and its wholeness is characterized by multiple and varied paths of interdependence. Thus, this paper advocates a holistic approach as requisite to understanding not only its myriad parts and functionality but also the forced changes imposed upon it both from within and without its domains. Furthermore, models can play a central role in intrusion detection, thus enabling information managers to develop protective and remedial courses of action. They can also be used to answer a wide range of questions, including how to deceive would-be intruders and lead them to believe they are inflicting damage on the real intended system. Through logically organized and systemically executed models, the Phantom System Models (PSM) laboratory, introduced in Section I, is aimed at providing a reasoned experimental modeling framework with which to explore and thus understand the intricate relationships that characterize the nature of multi-scale emergent systems. [ABSTRACT FROM AUTHOR]

Botnets and their attacks pose a significant threat to the Internet. If these are launched simultaneously at a large number of systems, they pose greater risks. Botnet is a collection of software agents, or robots, that run autonomously and automatically under the control of a head bot or herder to launch an attack. They are most commonly associated with malicious software, but it can also refer to a network of computers using distributed computing software. Bots are generally designed to carry out a variety of attacks like spamming, traffic sniffing, harvesting information etc. Although much has been written on various aspects of botnets, this paper concentrates on exploring the ease of recruiting bots, operating a botnet, and also discusses the threats of such botnets. As detection techniques improve, botnet design will continue to evolve to evade detection; thus, it is important to predict potential future botnet models for the purpose of developing defense mechanisms. This paper presents several strategies for botnet defense mechanisms and activities which should be carried out in order to establish successful defense. [ABSTRACT FROM AUTHOR]