Field Of Computer Security Research Articles

Editor's Note

Summary form only give, as follows. IEEE TDSC is today a well established journal in the field of information and computer dependability and security attracting top quality papers covering different topics within this field. This increase in quality and coverage has been made possible by the dedicated work of the Editorial Board Members and Reviewers and of Guest Editors who have over the years organized special issues on a variety of topics. As a result, the impact factor of IEEE TDSC has recently increased to 2. 926. Also in order to make it possible the timely publication of accepted papers, the TDSC’s annual page budget has been increased from 700 to 1100. This change will take effect in 2018 and I hope that it will help in further attracting high quality timely papers on topic of interest to the research community. Many individuals have contributed to the success of TDSC. First and foremost I would like to thank the authors for submitting their best research work to TDSC. Special thanks are due to the Associate Editors in Chief, Professor Joon-Gail Ahn (Arizona State University) and Professor Neeraj Suri (Technical University of Darmstadt); their advice and assistance on many different issues concerning TDSC have been invaluable. As my term of service as Editor-in-Chief will end on 1 January 2018, I would like to take this opportunity to express my gratitude to all the reviewers for their dedicated work in reviewing papers, and the Editorial Board and IEEE Computer Society Publications Staff for their continuous assistance. I would like to extend my best wishes to Professor Jaideep Vaidya, the incoming Editor-in-Chief of TDSC. His distinguished research track in the field of information and computer dependability and security gives us confidence that under his leadership this journal will continue to thrive in its mission to serve our research community.

A novel network security algorithm based on improved support vector machine from smart city perspective

Computer generated security concerns have become more modern and complex. Intrusion detection(ID) is a practical issue in the field of computer security whose primary objective is to detect rare attack or assaults and to ensure the security of interior systems. This paper also proposes a semi-class intrusion detection method that combines multiple classifiers to arrange exceptions and typical exercises in a computer system. The abuse detection model is constructed in the light of the decision tree learning-iterative dichotomise 3(DTL-ID3) and is assembled by utilizing the gathered data based on anomaly detection model executed by one class-support vector machine(OC-SVM). In recent years, people have paid more attention to ID/intrusion prevention system (IDS / IPS), which is closely related to the protection and utilization of system management. A few machine-learning standards including neural system, direct hereditary programming, and advanced support vector machines(ASVMs), Bayesian system, multivariate versatile relapse splines, fluffy derivation systems(FIS) and other analogical systems have been researched for the outline of intrusion detection system. In this paper, we build up an amalgam method based on DTL-ID3 and OC-SVM(A-DT and SVM) and evaluate the performance of the projected methodology by using a specific dataset and a crossover method in order to enhance the accuracy of IDS/IPS when contrasted with a singular support vector machine.

Development of protection mechanisms against DRDoS-attacks and combined DRDoS-attacks

Distributed “denial of service” attacks based on the traffic reflection and amplification (DRDoS attacks) still are a powerful threat for computer networks. More than half of all attacks were executed by using multiple types of attacks. Development of new protection mechanisms against such attacks is one of the most important tasks in the field of computer security. In this paper, we present experiments on DNS attack, NTP attacks and combined DRDoS-attack simulation. We simulated several protection mechanisms as well as a mechanism developed by us. We compared these protection mechanisms for different kinds of attacks.

Authentication based on keystroke dynamics using stochastic diffusion algorithm

ABSTRACTAuthentication plays an important role in dealing with security. Securing sensitive data and computer systems by allowing easy access for authenticated users and withstanding the attacks of imposters is one of the major challenges in the field of computer security. Nowadays, passwords have become the trend to control access to computer systems. Biometrics are used to measure and analyze an individual's unique behavioral or physiological patterns for authentication purposes. Keystroke dynamics have emerged as an important method in analyzing the typing rhythm in biometric techniques, as they provide an ease of use and increased trustworthiness associated with biometrics for creating username and password schemes. In this experiment, we measure the Hausdorff timing values, mean, standard deviation, and median of keystroke features, such as latency, duration, digraph, and their combinations, and compare their performance. The stochastic diffusion search is used for feature subset selection.

Developing a Novel Holistic Taxonomy of Security Requirements

Abstract Defining security requirements is of prime importance for all systems; we usually study the generic ones like confidentiality, integrity, availability, authentication, non-repudiation and privacy. It is thus imperative to evaluate all the possible extended requirements. A literature review has shown that there are various and different security requirements models, some of which are examined and others are neglected. Moreover, security lacks a unified taxonomy of security requirements. In this paper, we refer to the variety of security requirements models from the literature to drive an aggregate model and move away from the individualistic proposed taxonomy to a hierarchical and standard security requirement model. We define and propose a novel and holistic security requirement taxonomy at two levels of abstraction that incorporates 13 basic and standard requirements and then refined in layers into 31 security requirements sub-factors. These requirements are discussed in the open literature. Our taxonomy offers a good understanding of security constraints relevant to the system functions in the field of computer security. When it comes to decision making, it is recommended to establish which security measures should be relevant to the entire security requirements taxonomy.

베이지안 네트워크 개선을 통한 탐지율 향상의 IDS 모델

In recent days, a study of the intrusion detection system collecting and analyzing network data, packet or logs, has been actively performed to response the network threats in computer security fields. In particular, Bayesian network has advantage of the inference functionality which can infer with only some of provided data, so studies of the intrusion system based on Bayesian network have been conducted in the prior. However, there were some limitations to calculate high detection performance because it didn't consider the problems as like complexity of the relation among network packets or continuos input data processing. Therefore, in this paper we proposed two methodologies based on K-menas clustering to improve detection rate by reforming the problems of prior models. At first, it can be improved by sophisticatedly setting interval range of nodes based on K-means clustering. And for the second, it can be improved by calculating robust CPT through applying weighted-leaning based on K-means clustering, too. We conducted the experiments to prove performance of our proposed methodologies by comparing K_WTAN_EM applied to proposed two methodologies with prior models. As the results of experiment, the detection rate of proposed model is higher about 7.78% than existing NBN(Naive Bayesian Network) IDS model, and is higher about 5.24% than TAN(Tree Augmented Bayesian Network) IDS mode and then we could prove excellence our proposing ideas.

Malware detection method of android application based on simplification instructions

The amount of mobile malicious code is increasing faster every year and a serious security threat is posed by this. Hence, malware detection has become a critical topic in the field of computer security. This paper proposes a method to detect variants of known malware families in Android devices using simplify Dalvik instructions. This method is based on the sequence of instructions. A method is described in this paper to give the simplified description of each instruction and group them with n-gram patterns, which are set to be the malicious features. The result of the experiment shows that features extracted by this method are easy to be recognized, thus an effective way to detect variants of known malware families is provided.

Research on the Application of Spatial Logic in the Security Protocol Verification of Computer

The security protocol is the core technology of the network communication security system which can maintain the security of the network environment effectively. With the increasing of the amount of network data, how to make security protocol to meet customers needs for network and information security and how to improve the efficiency of the security agreement are the focuses of exploration of the field of computer security. This paper introduces the security agreement composite form based on the theory of computer logic program, strand space model theory and certification test method. It also expands the Kailar logic and concludes the automotive verification algorithm of security protocol AAAP-KM algorithm. At last, this paper verifies the effectiveness and fastness of AAAP-KM algorithm taking the KM security protocol for example which provide a theoretical reference and technical support for the application and research of cyberspace logical security agreement.

Lost Treasures

Is the computer security field really old enough to have lost treasures? Will a granite punch card with ancient Cobol contain some code fragment that produces a better firewall? Hardly. The computing environment changes so much and so radically that implementation details lose relevance quickly. However, concepts and key insights can serve modern developers just as well today as they did builders of ancient systems from the 1980s.

Research on software protection based on virtual machine

Software security protection has become an important topic in the field of computer security. Most of the traditional software protection methods are no longer suitable for the requirements of modern software protection. This paper presents a new virtual machine (VM)-based software protection program, by which the X86 assembly instructions are compiled into virtual instructions that VM can interpret and implement. This method can greatly increase the difficulty of reverse analysis, and protect the rights of software developers and intellectual property. In addition, this method adopts a random instruction generation algorithm which makes different software instructions generated by our solution, so that the software security can be improved greatly. It is presented by experiments that the protective effect of the method above is good in either static or dynamic condition.

Happy Anniversary!

IEEE Security & Privacy editor in chief John Viega looks back 10 years to how the computer security field has changed and evolved. Although the security industry has grown exponentially, are we any safer?

INANE 2011 ‐ Moving Editors into a “Brave New World”

The International Academy of Nursing Editors (INANE) held its annual meeting in San Francisco August 3–5, 2011. INANE is an “international collaborative” composed of nurse editors and publishers of nursing journals and books. (For more information see http://www.nursingeditors-inane.org/about.html) I feel compelled to comment on one of the presentations, a panel and breakout session titled “Welcome to the Brave New World of Social Media,” because I'm one of the old timers who has very little interest in the current environment of social networks, Twitter, online chat groups, and Internet gaming. I went into this session thinking, “Oh no, give me a break.” I left that morning session with a new appreciation for certain aspects of social media and how editors can use these tools to enhance content for our journals. I also came to the conclusion that it might not be me as the editor who does the blogging, the Facebooking, the Tweeting, but at the very least, I will be having a discussion with the editorial board, the association, and the publisher about where we should invest our energies. I am convinced that there is an appeal to many of our readers and I am impressed with what some journals have done in this area. As a start, I invite readers to check out the INANE website (http://www.nursingeditors-inane.org/index.html) home page at the bottom to see what is available for the nurse editor. We were honored with a guest blogger for the duration of the INANE conference (check tag “live blogging”) - none other than Cherry Ames, RN. Those of you who know the world of Cherry Ames now understand why some of us old timers may be reluctant entrants into the social networking arena. So that you don't think I'm a complete Luddite in this digital age, I would like to share some of my concerns about social networking. I have learned that many of these concerns can be mitigated with careful attention to Internet safety. That said, it pays to be very cautious about online privacy settings, “friending” and other linkages, as well as the content of any postings. My advice is to consult experts in the field of computer and network security, who may be as close as your publisher. Publishing companies have had to create secure platforms for hosting journals and books; most also have some kind of presence on social networking sites. For more detail on blogging, Facebooking, and Tweeting related to nursing, check out the presentations posted on the INANE website for the first day of the August 2011 conference. You will find examples of some journal blogs, strategies for setting up Facebook pages, and suggestions for getting started on Twitter to enhance the value of your journal or book. It seems that social media is really an excellent way to attract some readers to our journals. And, of course there are metrics that help you analyze the degree to which your social media efforts have attracted visitors to your site. But I will leave that for other experts to explain and interpret. Charon A. Pierson, PhD, GNP-BC, FAANP, is a Clinical Associate Professor and Director of the Center for Aging at the University of Texas El Paso School of Nursing and the Editor-in-Chief of the Journal of the American Academy of Nurse Practitioners. She is also the Editor of Nurse Author & Editor.

Building an Active Computer Security Ethics Community

In spite of significant ethical challenges faced by researchers evaluating modern threats, the computer security field has yet to grow its own active ethics community to describe and evaluate the ethical implications of its work. Modern threats such as denial-of-service (DoS) attacks, worms, viruses, phishing, and botnets underscore the need for Internet security research in an increasingly networked and computationally reliant society. This research involves not only appropriate responses but also difficult issues of privacy and responsible disclosure of vulnerability information.

Electronic access key based on innovative Information Fusion technique involving prime numbers and biometric data

This study shows an innovative system to create an access key which can be used within the field of computer security, and which can not only guarantee a high level of secrecy, but also, with a high level of certainty, provide a person identity through Information Fusion (IF) techniques. Specifically, two non-connected areas have been joined, Biometrics and Public-key Cryptography. This choice was taken in order to get through the limits these two approaches have found singularly. An innovative and original algorithm has been developed, which can do fusion operations between biometric and numerical data, that is an algorithm of Hybrid Information Fusion, named BNIF (Biometric & Numerical Information Fusion), we decided to use a digital fingerprint as a biometric component, and theproduct oftwoprime numbers as a numerical component, thatis the module in RSA algorithm.

Measuring Security

The field of computer and communications security begs for a foundational science to guide system design and to reveal the safety, security, and possible fragility of the complex systems we depend on today. To achieve this goal, we must devise suitable metrics for objectively comparing and evaluating the security of system designs and organizations.

Supervisory Control for Opacity

In the field of computer security, a problem that received little attention so far is the enforcement of confidentiality properties by supervisory control. Given a critical system <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</i> that may leak confidential information, the problem consists in designing a controller <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">C</i> , possibly disabling occurrences of a fixed subset of events of <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</i> , so that the closed-loop system <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</i> / <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">C</i> does not leak confidential information. We consider this problem in the case where <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</i> is a finite transition system with set of events ¿ and an inquisitive user, called the adversary, observes a subset ¿ <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">a</i> of ¿. The confidential information is the fact (when it is true) that the trace of the execution of <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</i> on ¿* belongs to a regular set <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">S</i> ¿ ¿*, called the secret. The secret <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">S</i> is said to be opaque w.r.t. <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</i> (respectively, <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</i> / <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">C</i> ) and ¿ <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">a</i> if the adversary cannot safely infer this fact from the trace of the execution of <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</i> (respectively, <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</i> / <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">C</i> ) on ¿ <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">a</i> *. In the converse case, the secret can be disclosed. We present an effective algorithm for computing the most permissive controller <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">C</i> such that <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">S</i> is opaque w.r.t. <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</i> / <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">C</i> and ¿ <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">a</i> . This algorithm subsumes two earlier algorithms working under the strong assumption that the alphabet ¿ <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">a</i> of the adversary and the set of events that the controller can disable are comparable.

Information and Quality Assurance: An Unsolved, Perpetual Problem for Past and Future Generations

Quality assurance is well understood in the hardware/manufacturing community but not necessarily within the software community. The meaning of Information assurance depends on who you ask; those in the computer security field interpret information assurance as the need to protect the information, those in quality assurance relate information assurance to the quality of the information. Software assurance ranks even poorer in understanding; although most would agree that it relates to quality, they would be unsure what that means. System assurance is well understood due to its basis on known systems-engineering principles, tending to emphasize the dichotomy of hardware and software concept understanding. In this issue, three articles address parts of the assurance puzzle, which includes: quality assurance, information assurance, software assurance, and system assurance. The combination of these four builds the argument for trust, which is the sole reason for building assurances. To help avoid costly mismatches, consider looking at which part of the assurance puzzle you need solved first before looking at supposed assurance solutions.

Interview: Silver Bullet Speaks to Marcus Ranum

In the third episode of the Silver Bullet Security Podcast, Gary talks with Marcus Ranum, who is an acclaimed security guru widely credited with inventing the proxy firewall. Marcus and Gary discuss why Marcus thinks we're not making progress in the computer security field, how common sense would help computer security, and Richard Feynman.

A noise-driven strategy for background estimation and event detection in data streams

A theory is presented for a discrete, finite-horizon, H ∞ filter that estimates background in a data stream. Threshold rejection is introduced into the theory by way of an approximation for the H ∞ observation innovation. The threshold is simply related to a basis variance that can either be provided as input or accumulated over the data stream. This framework identifies background as the portion of a data stream that varies within the bulk of the noise in the data. Unexpected events in the data stream are therefore synonymous with statistical outliers—especially successive outliers of the same direction. The resulting methodology is robust and suitable for real-time applications. It can handle types of background variation in which smoothing and band pass filtering are ineffective. There are no adjustable parameters because all such quantities either have universal values or are selected using well-defined principles. The performance of the filter is demonstrated using computer simulated data sets and arbitrary instrumental data. Examples of its application are also presented in the fields of finance and computer security.

Understanding the broadcast flag: a threat analysis model

The broadcast flag is supposed to protect digital broadcast content from unauthorized distribution. This paper critically examines the broadcast flag as a security mechanism in the context of digital content control. A threat model analysis from the computer security field is presented as a framework for evaluating the flag. The model identifies stated and potential goals of the flag's proponents and evaluates how well the flag protects these goals from diverse attacks. The paper finds that the flag does not adequately protect content from Internet redistribution and highlights a new intellectual property paradigm that the broadcast flag does protect.