Search

With the rapid Internet development, the cases of cybercrime keep increasing year by year and cost hundreds of millions of Ringgits in Malaysia every year. Malaysia government organizations MyCERT and CyberSAFE aim to increase information security awareness (ISA) of the public by providing general security recommendations. The ISA of the public should be measured to provide adequate analysis of the current security awareness level among Malaysians to establish enhancement on security areas. This study concerns profiling users with a computer-based automated ISA measurement by gathering the information in the computer from 5 focus areas of security (password management, email usage, internet usage, networking usage, and information handling). The ISA profile is created based on the result of ISA measurement by successfully implemented the automated ISA measurement. The profile reflects the behavior and attitude of the user on security, which contains useful information that can be further utilized such as the user profile of recommendation system on security.

As computing paradigm shift towards cloud computing; a new wave of distributed-denial-of-service (DDoS) has evolved to exploit cloud specific vulnerabilities to deny access to legitimate users. Cloud infrastructure employs defensive mechanism like load-balance flooding traffic; isolating data center and cloud traceback to mitigate service-oriented attacks and targeted DDoS optimized that is growing rampant. However, not all countermeasures are created equal. In this paper, we evaluate the preventive and real-time security measures used by three popular cloud providers (AWS, Azure and Google Cloud) in safeguarding cloud resources and maintain promised SLA in event of DDoS attacks. For real world practicality, we measure the inference speed of a machine-learning API on these cloud services using standard privileges (for fairness). We simulate some common DDoS like UDP flood, SYN flood and HTTP flood using HULK, LOIC, XOIC to the targeted server’s IP. For each prediction to the cloud, the latency (ms) for a completed inference request is measured during the ‘stress test’. Then, we compare the average latencies for consecutive requests to the ground truth (latency during normal operation) to evaluates the impact of DDoS to different cloud providers. The experimental results showed that Google Cloud and AWS are more resilient against targeted DDoS; where both services recorded less than 10 ms delta in latency differences. Meanwhile Azure infrastructure has is somewhat more susceptible to DDoS; where the worst-case latency rose up to 1316 ms from the average 640 ms during the attacks.

Modern data communication paradigm involves many unsolicited data transmissions that poses privacy issues given the proliferation of big data and artificial intelligence (A.I.). In 802.x protocol which dominate wireless communication; Wi-Fi enabled devices voluntarily embed devices MAC address during SSID discovery when connecting to access point (AP). Such vulnerability has been massively exploited for unauthorized devices tracking without user consents. This paper proposed an opportunistic attendance taking system (OATA) using MAC address probing as a proof of concepts to demonstrate the significance of this exploit. The intuition is that student’s attendance can be implied based on the MAC address of their mobile devices when approaching lecture hall installed with AP(s). The body of this work focuses on comparing the OATA to some prominent attendance taking methods in pervasiveness and accuracy. For the operational hypothesis, a non-synthetic dataset is used for experimental evaluation to simulate realness and to minimize hawthorn effect. OATA is designed to circumvent MAC address randomization that is used on modern IOS and Android OS for accurate tracking. The experimental results showed that OATA is highly accurate at capturing device’s presence; achieving true positive rate (TPr) of 0.938 and false positive rate (FPr) of 0.063 with fast convergence time. The significance of this study highlight the concerns that big data coupled with increasingly intelligent A.I. can divulge more information than originally intended. Consequently, user’s privacy is compromised as their personal communication devices are demonstrated to be potentially exploited for unsolicited location tracking.

Payload-based traffic classification use a subset of highly correlated payload bytes as signature to identify unlabeled traffic classes. However, these correlations diminish over time due to application behavioural changes, resulting in lower true positive in subsequent classifications. The short time-to-live of signatures means that signatures can become outdated quickly, and new set of signatures are needed to preserve classification accuracy. Extracting new signatures is computational expensive and not scalable to these continuous behavioural changes. This paper proposed a lightweight automatic signature extraction method that adaptively recalibrate the signature sets to reflect behavioural transitions using sliding-window mechanism. The algorithm use Leviathan Distance to detect the optimal number of payload bytes (K) needed to uniquely discriminate traffic classes. Sliding-k then shrink or expand the k value of the base signature to address for temporal changes instead of rebuilding new signatures completely. The experimental results showed that sliding-k is effective in reducing signature length while preserving classification accuracy for continuous traffic classification.

The introduction and adaptation of IPv6 addressing have taken great strides coherent to the proliferation of Internet of things. Devices are getting connected in the network plane for streamlined interoperability and to provide compound collaborative services; and although the expanded address space are proving handy they comes with added network management complexity. DHCPv6 assigns address to connected devices in ascending numerical order by default, while EUI-64 build address from MAC address value; hence in common skirmishes only the a least significant population of addresses are assigned depending on institution type. The abundant availability of unoccupied address motivates a new addressing scheme that dynamically assign address built as human perceptible information specific to corresponding node using combination of hex value prior to allocation. Device information are vastly available courtesy of many device identification methods such as NetBIOS and address book lookup, however there lacks a ubiquitous standard to properly define a device profile and their inherent attributes. A unified service discovery and aggregation are devised to collect device information, filter and dominate a tag that best represent the corresponding device, such as device type, device role or owner name. Embedding device information directly into IPv6 address are made possible with the large address space support. This gives rise to a perceptible and more management friendly addresses notation, in addition to being immune to record poisoning in resolving information directly from IP address, a privileges previously not afforded by conventional implementation.