Security Research Research Articles

An Approach to Secure Data Sharing in the Internet of Things Using Blockchain- Based Proxy Re-Encryption

The prevalence of data sharing has increased with the rise in popularity of cloud computing and the Internet of Things (IoT). However, ensuring data security is difficult because of the possible negative consequences of illegal data usage. This study presents a method for ensuring the secure transmission of data in cloud environments: proxy re-encryption. The identity-based encryption method enables data owners to transfer encrypted data to the cloud. Subsequently, a proxy re-encryption framework enables authorized individuals to access the data. To surpass the limitations of IoT device resources, we utilize an edge device as a proxy server to transfer computationally intensive tasks to a separate device. By utilizing the advantages of information-centric networking, we can optimize network capacity and enhance service quality by efficiently distributing cached content across the proxy. This method decreases bottlenecks in centralized systems while providing precise control over data access. The proposed work demonstrates the effectiveness of the strategy in ensuring data security, confidentiality, and integrity through thorough security research and plan review.

Factors Influencing Information Security Policy Compliance Behavior in High Education Institutions: Systematic Literature Review

Information security policies and behaviors play a crucial role in organizations, particularly in higher education institutions. These policies outline guidelines and best practices to protect sensitive data, safeguard privacy, and prevent unauthorized access or misuse of information. In higher education institutions, they help secure research findings, intellectual property, and student records. By fostering a culture of security awareness and encouraging responsible behavior, organizations can safeguard their reputation, instill trust, and meet legal and regulatory requirements. This literature review has revealed challenges and highlighted the current trends of information security policy compliance, as well as the theories used for information security compliance from 2013 to 2023. Out of 50 research papers published on the topic of information security policy compliance, three influencing factors were identified through filtration: behavioral intention, awareness and culture, and human with organizational management. The findings show that there is a lack of information security policies in the higher education sector. This review contributes to the information security literature by providing a fully organized systematic review of conducted research in the last decade.

Information Security Research in the Information Systems Discipline: A Thematic Review and Future Research Directions

Information security continues to grow in importance in all aspects of society and therefore evolves as a prevalent research area. The information systems (IS) discipline offers a unique perspective to move this stream of literature forward. Using a semiautomated thematic analysis approach based on the topic modeling technique, we review a broad range of information security literature to investigate how we may integrate and advance our understanding of information security. Our analysis reveals four major themes, including information security policy (ISP) compliance, motivations and susceptibility, software security decisions, and firm security strategy. We also identify a theme of security in broader contexts, in which studies consider the societal impacts of information security and online hacker behavior. This review contributes to IS literature by 1) synthesizing the broad range of information security research published in the top journals of the field, moving beyond prior reviews focusing on a narrower scope such as individual ISP compliance; 2) identifying major themes and proposing an overarching research framework encompassing these themes and their interconnections, allowing us to envision future research directions; and 3) enumerating a semiautomated topic modeling approach that other researchers can employ.

Securing tomorrow: a comprehensive survey on the synergy of Artificial Intelligence and information security

AbstractThis survey paper explores the transformative role of Artificial Intelligence (AI) in information security. Traditional methods, especially rule-based approaches, faced significant challenges in protecting sensitive data from ever-changing cyber threats, particularly with the rapid increase in data volume. This study thoroughly evaluates AI’s application in information security, discussing its strengths and weaknesses. It provides a detailed review of AI’s impact on information security, examining various AI algorithms used in this field, such as supervised, unsupervised, and reinforcement learning, and highlighting their respective strengths and limitations. The study identifies key areas for future AI research in information security, focusing on improving algorithms, strengthening information security, addressing ethical issues, and exploring safety and security-related concerns. It emphasizes significant security risks, including vulnerability to adversarial attacks, and aims to enhance the robustness and reliability of AI systems in protecting sensitive information by proposing solutions for potential threats. The findings aim to benefit cybersecurity professionals and researchers by offering insights into the intricate relationship between AI, information security, and emerging technologies.

HAformer: Semantic fusion of hex machine code and assembly code for cross-architecture binary vulnerability detection

Binary vulnerability detection is a significant area of research in computer security. The existing methods for detecting binary vulnerabilities primarily rely on binary code similarity analysis, detecting vulnerabilities by comparing the similarities embedded in binary codes. Recently, Transformer-based models have achieved significant progress in this field, leveraging their advantage in handling sequential data to better understand the semantics of assembly code. However, to prevent the out-of-vocabulary (OOV) problems, assembly code typically needs to be normalized, which would lose some important numerical and jump information. In this paper, we propose HAformer, a Transformer-based model, which semantically fuses hexadecimal machine codes and assembly codes to extract richer semantic information from binary codes. By incorporating the hexadecimal machine code and a newly designed assembly code normalization method, HAformer can alleviate the problem of numerical information loss caused by traditional assembly code normalization, thereby addressing the issue of OOV. Evaluation results demonstrate that our HAformer outperforms the baseline method in the Recall@1 metric by 16.9%, 25.5% and 19.2% in cross-optimization level, cross-compiler and cross-architecture environments, respectively. In real-world vulnerability detection experiments, HAformer exhibits the highest accuracy.

Synthesizing Information Security Policy Compliance And Non-compliance: A Comprehensive Study And Unified Framework

ABSTRACT In today’s organizational landscape, safeguarding information against both intentional and unintentional insider threats has become a paramount concern. To address this challenge, organizations formulate Information Security Policies (ISP) aimed at maximizing compliance regarding sensitive data and information. However, confining the analysis solely to compliance falls short, as even a minor fraction of non-compliant individuals can lead to significant organizational vulnerabilities. In such scenarios, it becomes imperative for organizations to delve into the intricacies that influence both ISP compliance and noncompliance. While numerous literature reviews have explored factors contributing to ISP compliance, they often treated compliance and noncompliance as mere opposites, neglecting their nuanced differences and the need for a combined perspective. Our study bridges this gap by conducting a comprehensive review of 50 peer-reviewed articles published between 2014 and 2022. This unique undertaking yields three crucial contributions: First, it elucidates the characteristics distinguishing ISP compliance and noncompliance within business contexts. Second, it provides an encompassing explication of the variables influencing both ISP compliance and noncompliance. Most notably, our review culminates in the development of a unified framework that amalgamates existing insights and charts a path for future inquiry.

Ecological Security Pattern based on XGBoost-MCR model: A case study of the Three Gorges Reservoir Region

The ecological resistance surfaces (ERS) are a critical component in constructing the Ecological Security Pattern (ESP) and reflects the ecological security level of a region. However, research on optimizing the construction of the ERS is limited. This study focuses on selecting 11 ecological resistance factors from two categories: natural conditions and human activities. Using the XGBoost (eXtreme Gradient Boosting) - MCR (Minimum Cumulative Resistance) algorithm, a comprehensive framework to analyze the ESP in the Three Gorges Reservoir Region (TGRR) is constructed. The results reveal the following key findings: (1) The ecological source areas in the TGRR decrease from northeast to southwest, covering a total area of approximately 12,400 km2, accounting for 21.57% of the total area. (2) The ecological corridors amount to 45, exhibiting spatial distribution patterns that vary across different regions. In the northeast, ecological corridors demonstrate a branching and radial distribution pattern, while in the southwest, they primarily extend along the edges of the study area. Corridors in the central region extend from west to east. (3) The ecological security assessment based on the XGBoost algorithm demonstrates high reliability, as the predicted results align well with the actual conditions in the TGRR. (4) The comprehensive framework of the ESP, based on the XGBoost-MCR model, allows for automatic optimization of algorithm parameters using known environmental samples. The study contributes scientific references to ecological environmental protection in the TGRR, while also offering valuable insights for optimizing ERS construction, ESP development, and integrating machine learning techniques in ecological security research.

Expressing opinions about information security in an organization: the spiral of silence theory perspective

Purpose Expressing views on organizational information security (IS) by employees is vital for improving security processes, policies and trainings, while non-communication may conceal the true state of the human factor of IS and lead to security breaches. The purpose of this paper is to introduce the concept of opinion expressing about organizational IS, provide an explanatory model based on the theory of spiral of silence and offer its empirical validation. Design/methodology/approach Data from a web-based survey among the employees of one the universities in the European Union (n = 504) was analyzed with regression analysis to investigate the proposed hypotheses. Findings The study reveals that employees with positive opinions about IS will be more willing to share their opinions with coworkers and management. However, when employees perceive that their pro-IS opinions are not shared by other coworkers, they will remain silent, which increases the risk of problematic opinions spreading throughout the organization. Research limitations/implications The study highlights the need to focus on the communication perspectives of organizational information security, an area often overlooked in the human factor of information security research. Practical implications The results highlight the need to examine the gap between the dominant climate of opinion about IS in the organization and the display of compliant IS behaviors in order to strengthen IS endeavors. Organizations are encouraged to facilitate open dialogue about IS processes, policies and training and implement mechanisms for considering employees’ feedback in order to improve the organization’s IS. Originality/value The study contributes to a growing body of research that moves beyond viewing employees merely as subjects of compliance, recognizing instead their agency in IS issues that can enhance organizational resilience. To the best of the authors’ knowledge, this is the first study to apply the spiral of silence theory in the IS field, thereby helping to overcome the lack of communication science perspectives in organizational IS research.

Disaster, risk and conducting human security research in Southeast Asia

PurposeTyphoons, storm surges and sea-level rise pose major risks to life and livelihoods in Southeast Asia and demand state-level action. However, the prominence and frequency of these symptomatic disasters often divert attention from underlying systemic and situational issues. The purpose of this paper is a normative and conceptual one. It makes the case for a grounded and disaggregated human security approach for decoding complex relationships of risk, power, politics, inequality and mistrust that underpin problems we seek to address.Design/methodology/approachThis paper’s approach situates the emergence of the human security paradigm and its connections to human development, sustainable economic growth and rights-based protections in historical context. It then draws on observations across the region over a number of years combined with a review of relevant research to detail how the vulnerability and exposure to disaster of at-risk communities extend beyond random or natural events. Having established that a focus on the immediate characteristics of disaster limits our frames of reference and the utility of subsequent responses, it proceeds to analyse the political, environmental and economic drivers amplifying exposure to disaster in Southeast Asia.FindingsThe findings reveal that the vulnerability and insecurity experienced by at-risk communities are not wholly random or exclusively the result of natural, unavoidable events. Exposure to disasters is also shaped by various situational factors, including habitat loss, dispossession, displacement, marginalisation and limited opportunities. Incorporating a more holistic human security perspective can bring into focus the less visible forces and interests that amplify vulnerability to hazard risk for affected individuals and communities in the region.Originality/valueThis is an original paper that underscores the conceptual and methodological importance of a grounded and disaggregated human security approach to grasp the disaster-prone territories of risk in contemporary Southeast Asia and for advancing appropriate responses.

International Aspect of PRC Information Security Policy

This article examines the international aspect of China’s information security policy. Due to the fact that the information sphere is becoming increasingly important in relations between states, the appeal to the policy of one of the leading international actors — the People’s Republic of China — is in demand and relevant. China’s experience in ensuring information security may be in demand in other countries, including the Russian Federation.Aim. The purpose of the article is to characterize the international aspect of China’s information security policy and to reveal the specifics of China’s interaction with other countries in this area.Tasks. To achieve this goal was conducted a review of key international documents ensuring the international information security of the People’s Republic of China, as well as the country’s domestic legislation in this area. Also the issue of confrontation between China and the United States in the information space was considered.Methods. The study employs the historical method to examine the development of China’s information security system, document analysis to review China’s domestic and international legislation in the field of information security, and comparative analysis to compare the approaches of different countries in the field of cybersecurity.Results. The conducted research highlights the following key outcomes: In the context of the Shanghai Cooperation Organization (SCO), Сhina demonstrates a commitment to the joint development of international legal norms in the field of information security, as well as actively participates in the creation of cooperation agreements in this area, emphasizing the state’s role as an advocate for a multipolar world in cyberspace. Within the framework of interactions with the BRICS countries, China aims to deepen cooperation in the field of information security through a series of initiatives and agreements aimed at developing common approaches and standards. This cooperation contributes to the creation of a unified protection system in the information sphere among the BRICS countries, strengthening their positions in the international information space. In relations with the United States of America, the interaction of China is characterized by competition and confrontation, especially in the context of cybersecurity. This includes differences in approaches to regulating the information space and cyber espionage. Nonetheless, existing contradictions and conflicts underscore the need for dialogue and cooperation to develop common international rules of behavior in cyberspace, which can contribute to ensuring international information security and stability.Conclusions. The international aspect of the China’s information security policy reveals various forms of interaction with other countries, each with its unique features. These relationships form a multi-level system of international information security, in which the PRC plays a key role, aiming to create a balanced and secure information space.

Efficiently Detecting Reentrancy Vulnerabilities in Complex Smart Contracts

Reentrancy vulnerability as one of the most notorious vulnerabilities, has been a prominent topic in smart contract security research. Research shows that existing vulnerability detection presents a range of challenges, especially as smart contracts continue to increase in complexity. Existing tools perform poorly in terms of efficiency and successful detection rates for vulnerabilities in complex contracts. To effectively detect reentrancy vulnerabilities in contracts with complex logic, we propose a tool named SliSE. SliSE’s detection process consists of two stages: Warning Search and Symbolic Execution Verification . In Stage 1, SliSE utilizes program slicing to analyze the Inter-contract Program Dependency Graph (I-PDG) of the contract, and collects suspicious vulnerability information as warnings. In Stage 2, symbolic execution is employed to verify the reachability of these warnings, thereby enhancing vulnerability detection accuracy. SliSE obtained the best performance compared with eight state-of-the-art detection tools. It achieved an F1 score of 78.65%, surpassing the highest score recorded by an existing tool of 9.26%. Additionally, it attained a recall rate exceeding 90% for detection of contracts on Ethereum. Overall, SliSE provides a robust and efficient method for detection of Reentrancy vulnerabilities for complex contracts.

Incorrect compliance and correct noncompliance with information security policies: A framework of rule-related information security behaviour

Information security policy (ISP) compliance is recognized as a key measure for dealing with human errors when protecting information. A considerable and growing body of literature has studied the persuasive, deterrent, and coercive antecedents of compliant and noncompliant behaviour. Simultaneously, research indicates that real life situations are too complex and varied to prescribe in terms of a priori rules of acceptable behaviour, and create situations where compliance is in fact harmful for achieving organisational security and business goals. Thus, regarding ISP compliance as inherently “correct” and noncompliance as inherently “incorrect”, may contribute to creating problems that compliance research seeks to alleviate. In this research perspective, we argue that ISP compliance and noncompliance cannot be universally and invariably determined as “correct” or “incorrect” but that they become meaningful only when evaluated against organisational outcomes. We draw on organisational accident theorists to develop our arguments and propose a framework of rule-related information security behaviour (RISB) in order to conceptualize different types of ISP compliant and noncompliant behaviour and their organisational outcomes. Our research argues that compliance and noncompliance are nor inherently correct or incorrect and that making the judgement on the correctness of these actions requires considering the rule, the action, and the outcome.

Secure-by-Design Real-Time Internet of Medical Things Architecture: e-Health Population Monitoring (RTPM)

The healthcare sector has undergone a profound transformation, owing to the influential role played by Internet of Medical Things (IoMT) technology. However, there are substantial concerns over these devices’ security and privacy-preserving mechanisms. The current literature on IoMT tends to focus on specific security features, rather than wholistic security concerning Confidentiality, Integrity, and Availability (CIA Triad), and the solutions are generally simulated and not tested in a real-world network. The proposed innovative solution is known as Secure-by-Design Real-Time IoMT Architecture for e-Health Population Monitoring (RTPM) and it can manage keys at both ends (IoMT device and IoMT server) to maintain high privacy standards and trust during the monitoring process and enable the IoMT devices to run safely and independently even if the server is compromised. However, the session keys are controlled by the trusted IoMT server to lighten the IoMT devices’ overheads, and the session keys are securely exchanged between the client system and the monitoring server. The proposed RTPM focuses on addressing the major security requirements for an IoMT system, i.e., the CIA Triad, and conducts device authentication, protects from Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, and prevents non-repudiation attacks in real time. A self-healing solution during the network failure of live e-health monitoring is also incorporated in RTPM. The robustness and stress of the system are tested with different data types and by capturing live network traffic. The system’s performance is analysed using different security algorithms with different key sizes of RSA (1024 to 8192 bits), AES (128 to 256 bits), and SHA (256 bits) to support a resource-constraint-powered system when integrating with resource-demanding secure parameters and features. In the future, other security features like intrusion detection and prevention and the user’s experience and trust level of such a system will be tested.

Promoting Security Behaviors in Remote Work Environments: Personal Values Shaping Information Security Policy Compliance

Organizations worldwide face critical concerns related to cybersecurity threats and information security policy (ISP) compliance. Even though humans are the weakest link in the cybersecurity chain, information security professionals understand the importance of promoting individual information security behaviors because employees are also the first line of defense against ever-increasing cyber threats. Despite a recent trend of working from home, organizations do not make significant differences in their information security interventions for remote workers, relying mainly on VPNs as the only used tool, essentially making employees follow in-office standard information security policies because they are “virtually in-office.” Our study suggests that organizations need to recognize the unique context of remote work and consider personal motivations when shaping information security practices. Furthermore, our study indicates that in order to motivate remote employees to follow secure information security practices, organizations should consider personal characteristics instead of focusing on generic interventions. For instance, our study compares onsite and remote workers, suggesting that personal values are more relevant in remote work settings. Our findings exemplify just one of the many potential personal characteristics to be considered, highlighting how personal values are important motivators for ISP compliance and how they differ for onsite and remote workers in their importance when following information security rules.

Efficient and robust disaster recovery system using cloud-based algorithms with data integrity

Incorporating cloud-based algorithms for disaster recovery (DR), it explores data replication, failover, virtual machine (VM) migration, and consistency algorithms. These algorithms play a pivotal role in safeguarding data and system continuity during unforeseen disruptions. Data replication ensures redundancy, failover algorithms swiftly transition to backup resources, VM migration facilitates resource optimization, and consistency algorithms maintain data integrity. Leveraging cloud technology enhances the effectiveness of these algorithms, providing robust DR solutions critical for business continuity in today's digital landscape. The recent growth in popularity of internet services on a massive scale has also raised the demand for stable underpinnings. Despite the fact that DR for big data is frequently overlooked in security research, the majority of existing approaches use a narrow, endpoint-centric approach. The significance of DR strategies has grown as cloud storage has become the norm for more data. But traditional cloud-centric DR techniques may be expensive, thus less expensive alternatives are being sought. There is persistent concern in the information technology (IT) community about whether or not cloud service providers (CPs) can guarantee data and service continuity in the event of a disaster.

Social security and pension trends. A bibliometric study

This article presents a bibliometric analysis of trends in pension studies in the field of social security, using Zipf's law, Lotka's law and the h-index. The research focused on identifying productivity and citation patterns and determining the main research themes and trends. Through term frequency analysis, it was observed that the words "pensions," "social security," and "sustainability" are predominant, confirming Zipf's law. Lotka's law was validated by finding that a small group of authors is responsible for most of the publications, indicating a concentration in scientific production. The h-index calculation showed that the most prolific authors are also the most cited, reflecting their influence in the field. Thematic trends reveal a shift from implementing pension systems towards sustainability and reforms for regime changes. Furthermore, the geographical distribution highlighted a high concentration in developed countries with increasing international collaborations. These findings provide a comprehensive overview of research dynamics and offer recommendations for future research and policies in social security

A condition-based distributed approach for secured privacy preservation of nodes in wireless sensor networks IoT

The fast expansion of wireless sensor network-internet of things (WSN-IoT) in recent years has led to the adoption of a vital infrastructure. Adversaries who work together to carry out privacy-related attacks and capture sensitive information from critical infrastructure for a range of personal, political, and commercial purposes, thus security and node preserving have been one of the key areas of research in WSN-IoT. Existing security and privacy research work focuses on cryptography, either which is less efficient, or it majorly focuses on securing the network, which further leads to exposing the nodes to the vulnerability in terms of privacy in the network. This research develops condition-based distributed privacy-preserving (CDPP) approach to preserve the sensor node privacy; the CDPP algorithm develops a condition based on which the nodes' vulnerable information is preserved and not accessed by the compromised nodes. CDPP architecture is evaluated considering the amount of misclassified nodes for safeguarding the node in the network. CDPP is evaluated by inducing the corrupt nodes and further comparing the model with existing low energy adaptive clustering hierarchy (LEACH) based on classification, misclassification and throughput. Furthermore, comparative analysis proves the marginal improvisation in terms of discussed parameter against existing protocol.

A Comprehensive Survey for Hiding Medical Data Based DNA Lossless Technique

The health information data includes reports on the patient’s condition, including addresses, names, tests, treatments, diagnoses, and medical history. It is sensitive information for patients, and all means of protection must be provided to prevent third parties from manipulation or fraudulent use. The goal of this paper presents studies of safeguard the transfer of sensitive data over an unsecured network using DNA techniques to enhance security. A comparison analysis is used to show the security issues of the various DNA-based data (ciphering, concealing, and compression) techniques that are studied and investigated. Also, in our study is to provide future researchers with the necessary knowledge to conduct data security research to develop or improve DNA-based data- ciphering, compression-hiding strategies that are more reliable, secure, and efficient. Thus, future researchers need to propose a trustworthy DNA-based data (ciphering, hiding, and compression) techniques. The result of our study appears the perceived vulnerability of medical data and health insurance to concerns of security as well as common security issues, also the nature of these common security concerns, for reducing medical data security risks.

Turning global water security research into policy and action

Turning global water security research into policy and action

A Bibliometric Analysis of Legal Approaches to Personal Data Protection

This study employs bibliometric analysis to explore the expansive field of data privacy and security, utilizing data extracted from VOSviewer to identify thematic clusters, discern research trends, evaluate research opportunities, and analyze author collaboration networks. The analysis reveals several key thematic areas, including data security, legal frameworks, information privacy, and technological challenges associated with big data. These themes have evolved over time, demonstrating a shift from foundational legal principles to addressing complex technological and demographic-specific challenges, such as those related to children's data privacy. The study highlights significant concentrations of research activity as well as less explored areas that offer new opportunities for research, such as the legal status of data and specific privacy concerns that are under-represented in current literature. Furthermore, the author collaboration network provides insights into the structure of the research community, showing both dense clusters of collaboration and potential for new entrants to establish niches in emerging topics. This bibliometric perspective not only elucidates the current landscape of data privacy and security research but also points to future directions that can enhance the field's development.